Who this reaches
Commonwealth entities and suppliers handling government information, according to the relevant entity's classification, risk assessment, procurement, PSPF, ISM, and authorisation requirements.
What the rule requires
Government cloud consumers assess whether a service is suitable to store, process, and communicate the intended data. The assessment considers classification, architecture, controls, provider access, contractual requirements, and independent assurance such as IRAP where required.
What changes when the email path is regional
Boundry can provide an Australian regional architecture and a data-path account that a government supplier can include in its own cloud and vendor assessment.
What your team still owns
Boundry is not IRAP assessed and does not claim Australian Government certification. The customer must obtain the authorisation and assurance required for its information and contract.
Read the primary sources
This is an engineering and vendor-evaluation guide, not legal advice. Confirm the current rule for your entity, contract, and workload from the primary source.