VMware ramps up govt play with fresh IRAP assessment

Brad Anderson (VMware)

VMware is ramping up its federal government play with its VMware Cloud on Amazon Web Services (AWS) offering being independently assessed by an Information Security Registered Assessors Program (IRAP) assessor against the Information Security Manual (ISM) ‘protected’ controls.

The federal government’s IRAP framework endorses individuals from the private and public sectors to provide cyber security assessment services to Australian government entities.

The independent assessment of VMware Cloud on AWS means that the virtualisation vendor’s offering, which is a jointly-engineered service from AWS and VMware, has been evaluated as having the required security controls in place to be considered by government agencies for work involving the management of ‘protected’ data. 

Developed by the Australia Signals Directorate (ASD) and the Australian Cyber Security Centre (ACSC), IRAP is a security compliance framework involving security assessment processes and a security assessor program.

Broadly, it supports the country’s federal government entities in maintaining their security assurance and risk management as well as assessing cloud service providers and their cloud services’ security controls against the Commonwealth security policies and guidelines.

The ASD’s Cloud Services Certification Program (CSCP), which previously was responsible for granting IRAP certification to cloud services providers for consumption by government agencies, ceased operation in 2020, with all ASD certifications and re-certifications for secure cloud services becoming void from July.

In late July last year, the ACSC unveiled new guidelines for allowing cloud service providers to sell to the federal government, handing more responsibility over to individual agencies themselves.

The move meant that cloud service providers (CSPs) would no longer need certification from the ACSC and instead would need reviews from the information security registered assessors program every two years.

“Today marks a significant step in our continued commitment to Australian government customers, with the completion of the IRAP assessment for VMware Cloud on AWS,” VMware Australia and New Zealand vice president and managing director Brad Anderson said in a post on social media.  

“With citizens relying on digital government services more than ever before, this gives our public sector customers confidence to accelerate their cloud transformation and empower the delivery of flexible, resilient digital citizen services,” he added.

Broadly, VMware Cloud on AWS provides an integrated hybrid cloud solution that extends on-premises vSphere environments to a VMware Software-Defined Data Centre – such as vSphere, vSAN and NSX Data Center – running on Amazon Elastic Compute Cloud (Amazon EC2) elastic, bare-metal infrastructure.  

The service is fully integrated as part of AWS and optimised with AWS services, according to VMware.  

Now, the assessed service has the capability of providing public sector customers with the opportunity to tap into the service to accelerate their cloud migration and support business resiliency while maintaining operational consistency with their on-premises environments.

“We’re committed to providing our government customers with the choice and flexibility to select the solution that best suits their digital needs,” said Mike Reddie, VMware A/NZ cloud senior director. “In today’s market, it’s critical that the public sector not only has access to technology and services to enable transformation, but that they have confidence in its security in order to maintain data safety and meet compliance requirements.  

“We are focused on continually innovating our offerings to help our customers meet their business needs. We’re pleased that our IRAP 'protected' status will further broaden access to VMware Cloud on AWS, to support public sector customers in delivering flexible, resilient digital citizen services,” he added.