ServiceNow receives unclassified DLM status from Australian government
ServiceNow is now on the ASD Certified Cloud Services List (CCSL), allowing the California-based company to host unclassified dissemination limiting marker (DLM) government information on its local clouds.
To achieve certification, ServiceNow was audited by an independent assessor endorsed under the Information Security Registered Assessors Program (IRAP), which is governed and administered by the ASD.
The security assessment examined the security controls of ServiceNow's people, processes, and technology to meet Australian government standards, including a review of ServiceNow's Australian datacentres in Sydney and Brisbane.
ServiceNow boasts a range of government customers, including GovDC, Transport for NSW, Service NSW, and Parks Victoria. ServiceNow Australia and New Zealand MD David Oakley said these customers use his company's platform to modernise, transform, and innovate enterprise-wide service delivery.
"We are very pleased to receive this recognition by the Australian government, which will help provide local, state, and federal government agencies the reassurance to accelerate their move to the cloud," Oakley said.
Although the ASD certification means government agencies and departments can use the ServiceNow cloud, the addition to the CCSL does not automatically see them doing so. Instead, government entities have a choice of which cloud provider to turn to, providing they require unclassified DLM storage.
Similarly, Australian enterprise software provider TechnologyOne announced in May that its enterprise software-as-a-service (SaaS) solution is certified to the highest standard by the ASD.
Clarifying with ZDNet a week later, Iain Rouse, group director of cloud, research, and development at TechnologyOne, admitted that its IRAP certification does not give it an automatic green light to provide the Australian government with a SaaS solution; rather, it is a way of showing customers that it is serious about continuous improvement and ticking as many compliance boxes as possible.
IRAP certification does not immediately promote the company to be certified to the highest standard by the federal government itself. Instead, it means the company has been certified to the highest standard under the IRAP criteria.
In March, the ASD awarded protected-level ASD Certification to Sliced Tech and Vault Systems, allowing the local duo to store highly classified government information in their respective cloud platforms.
Protected-level is the highest certification level achievable.
At the same time, seven cloud vendors in the local market were granted unclassified DLM status -- with ServiceNow joining the list -- which still allows for the storing of sensitive government data, but at a less protected level.
Rounding out the local offerings, Australian telecommunications provider Macquarie Telecom received Unclassified DLM certification for its GovZone (launch) offering.
Amazon Web Services (AWS) made the list for its EBS, EC2, S3, and VPC offerings; IBM for Bluemix; Microsoft with its Azure cloud, Dynamics CRM Online, and Office 365 platforms; and Salesforce with its platform-as-a-service (PaaS) and SaaS offerings.
Microsoft received further accreditation from the ASD in June that saw Australia's intelligence agency formally certify 50 services on the ASD CCSL across Azure and Office 365.
At the time, Microsoft Azure Engineering Lead for Australia James Kavanagh, as the company's Australian national technology officer, told ZDNet there were services "coming downstream" to allow government organisations to "go beyond" just the unclassified data route.
Microsoft last month then announced the launch of two new Australian datacentre regions at Canberra Data Centres (CDC) to offer Australian governments access to Microsoft Azure from early 2018.
CDC built its facilities in advance as top secret, which allows Microsoft to offer services from within CDC, inheriting the characteristics already in place and thus complying with Australian government requirements.
The local datacentre player is 49 percent owned by the Commonwealth Superannuation Corporation, which provides super services and products to Australian government employees and employers.
CDC signed a deal with Optus Business in June that will see the telco's business arm offer up its secure private cloud service to Australian government agencies.