Verification chain
Four things are pinned, and each can be checked independently of the others.
The assessment PDF. SHA-256: c6a9275e1d937e54e5b055b5465647d3ebc4dcec8c3e16f009e37385e8c92fe7
Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.
The timestamp. The receipt AOS-ASR-2026-001-v1.2.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 20 August 2026 and pending confirmation in the Bitcoin blockchain at the time of publication. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.
The assessed source. The assessment rests on 22 pinned artefacts: 15 retrieved and pinned by this case, and 7 inherited under convention 7 from other cases in this corpus, each re-verified against its recorded hash before this record was written. All 22 are pinned by hash and all independently archived. Quotations were checked against page images, not against a text layer alone; vocabulary counts state the artefact they were taken from and the control word run on the same extraction.
| Ref | Artefact | SHA-256 | Third-party copy |
|---|---|---|---|
| G-ASD-1 | ASD, Cloud assessment and authorisation (January 2024), 26 pages, publisher PDF. The document PSPF Release 2025 section 15.2.3 defers to by name. Carries the 'Cloud service provider locality and ownership' section and the five-item list a cloud consumer is to consider | 318d58dab8753ad1e3261b351aeac548586632e1208f2105f343aa510c394147 | archived copy |
| G-ASD-2 | ASD cyber.gov.au, Cloud assessment and authorisation landing page as served; links the January 2024 PDF and no other document [PINNED AND NOT RELIED ON - no claim in AOS-ASR-2026-001 cites this artefact; it is held because it establishes that the referral resolves to a page linking one PDF and no other] | 7e1432c5c1e7d60df5805c5e80a76f23c6a8bbcb0caae683c65387ac1ec23253 | archived copy |
| G-ASD-3 | ASD cyber.gov.au, Cloud computing hub page as served; lists eight cloud publications and is what the Common Assessment Framework footnote resolves to | d41bf6a4f49946a81563c571db667e7b1da46b4caa928baad02f823370e22d1e | archived copy |
| G-UK-1 | UK NCSC, Cloud security principle 2: asset protection and resilience, as served; carries principle 2.1 physical location and legal jurisdiction | 7c94d413a8f4a2b2db21ca9d24ce4bd57ba069de441eb1360b69249c4615b750 | archived copy |
| I-ISM-2 | ISM Guidelines for procurement and outsourcing (June 2026), PDF chapter, 9 pages, linked from I-ISM-1 [INHERITED CAPTURE, convention 7] Retrieved under ism-procurement-2026-08 on 2026-08-15T11:56:22Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | 272cc6cdc11ecce202fe1969dcddefbd31317b40b2b5b27f8e6b8999de978048 | - |
| AT-PSPF-1 | Protective Security Policy Framework, Release 2025, Department of Home Affairs, PDF, 165 pages [INHERITED CAPTURE, convention 7] Retrieved under attestation-survey-scoping-2026-08 on 2026-08-05T05:20:00Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | 8ae69e9542e1f1894fbd2bc74b3f0b8ef4a05282d9719d9e992279adcf34e69d | archived copy |
| L-PSPF-1 | PSPF Direction 001-2024 Managing Foreign Ownership, Control or Influence Risks in Technology Assets - operative PDF, 2 pages, signed Stephanie Foster PSM, Secretary, Department of Home Affairs, July 2024; page states publication date 5 July 2024 [INHERITED CAPTURE, convention 7] Retrieved under compellability-landscape-2026-08 on 2026-08-11T08:07:20Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | d7e5c62e7abb31e3d1bec66dc63519ca434ccfded71399256e154166fea1f9ea | archived copy |
| AT-HCF-2 | Hosting Certification Framework, March 2021 v2, the published framework PDF linked from the Framework page [INHERITED CAPTURE, convention 7] Retrieved under attestation-survey-scoping-2026-08 on 2026-08-05T05:25:24Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070 | archived copy |
| L-CPR-1 | Commonwealth Procurement Rules 2025, dated 17 November 2025 (Department of Finance), 36 pages [INHERITED CAPTURE, convention 7] Retrieved under compellability-landscape-2026-08 on 2026-08-11T08:20:37Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | 1b1d08c2d87e2c966d2d31e7923e2ccc2352b8fa132d4aee009116f934360a28 | archived copy |
| IR-ASD-1 | ASD, IRAP Policy and Procedures, version 2.0, June 2026 (central instrument) [INHERITED CAPTURE, convention 7] Retrieved under irap-assessor-scoping-2026-07 on 2026-07-31T05:39:39Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | a79e18571370c718f56f3052041e0dca17ee1c13080feccbf203e80723f7967a | archived copy |
| IR-ASD-8 | ASD, IRAP Common Assessment Framework (April 2025 file path) [INHERITED CAPTURE, convention 7] Retrieved under irap-assessor-scoping-2026-07 on 2026-07-31T05:45:16Z and re-verified against its recorded hash on 2026-08-19. The blob is held in that case; this row records the practice's re-verification and is excluded from this case's stated capture window | 38ef54f2c0a565143cdf8658d47d4a1aacc545835bb5c069626e6e723d2c089e | archived copy |
| G-ASD-5 | Blueprint for Secure Cloud, page as served. NO PDF IS PUBLISHED for this item: the publication is the page itself, and the page is the artefact [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | 62652d9f445073c27c86c7c1cbee8c96e61595ef74da7893d7859b516270d46a | archived copy |
| G-ASD-6 | ASD, Cloud assessment and authorisation FAQ, 4 pages [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | a1dd8b488f7e330096b47fcf8b5057917630bbe0688c19347e5e5b77498eb47e | archived copy |
| G-ASD-7 | ASD, Cloud computing security for cloud service providers, 4 pages. Carries the mitigation table whose item 11 asks a provider to disclose the countries and legal jurisdictions where tenant data is stored, backed up, processed and accessed [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | 86f0debd33309ded399383aeadbfe1cb93152f2d9fb74401b6bc1a7e7b15b700 | archived copy |
| G-ASD-8 | ASD, Cloud computing security for executives, 4 pages [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | 68bd0ad00c255ac6004f9b798fca619aa65fcc53a7ec783f02a0f2f41a25c7b0 | archived copy |
| G-ASD-9 | ASD, Cloud computing security for tenants, 4 pages [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | 5d4c0502745698f1a26299b08779c71d3c33c568a5cbdde1cc000784c082bbf5 | archived copy |
| G-ASD-10 | ASD, Cloud shared responsibility model: Executive guidance, 4 pages [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | f85c0f6acce3f450701331b7f46f8b7163541af931e0c29d923cf89e2c897740 | archived copy |
| G-ASD-11 | ASD, Cloud shared responsibility model: Guidance for individuals and small and medium businesses, 5 pages [PINNED AND NOT RELIED ON - read 19 August 2026; no claim in AOS-ASR-2026-001 rests on it] | 7ed56186b7bbbc0461332aac9702b5b7b87407036f74b7caf4065a7e6d0ba5f4 | archived copy |
| G-NIST-1 | NIST Special Publication 800-145, The NIST Definition of Cloud Computing, 7 pages. The terminus of the ASD Cloud assessment and authorisation terminology referral | 7b0c1a9fdfc67218b8ba2098f448c100c27070db91736b3c87fed63bfa21d418 | archived copy |
| G-NIST-2 | NIST SP 800-53 Rev. 5 publication landing page as served [LANDING PAGE ONLY - the control catalogue itself was not retrieved and is not read] | 6ff76e3c002d952b3b2c53b8deaf3df1de1fafeafcc9401d8188858d2d960baa | archived copy |
| G-NIST-3 | NIST SP 800-161 Rev. 1 publication landing page as served [LANDING PAGE ONLY - the control catalogue itself was not retrieved and is not read] | 58d81f8f626a9dbbbf2ec2c5308999d639acc030fd032ea4bf3a13a9f449c2cb | archived copy |
| G-CSA-1 | Cloud Security Alliance, Cloud Controls Matrix research page as served [LANDING PAGE ONLY - the matrix itself was not retrieved and is not read] | 6ac943569490de959d508bf054a44ee46f4d4559aef1febc43c62c4359470a9f | archived copy |
21 of 22 pinned sources have a third-party capture, each fetched back and confirmed to be the artefact. 14 of those 21 archived bodies hash identically to the copy pinned above. The other 7 are dynamically served web pages whose bytes differ from the pinned capture. For 6 of those 7 the extracted text is identical to the pinned copy, character for character; for those, the archived copy establishes that the page existed and what it said, not that the bytes are the same bytes. G-CSA-1’s archived text also differs, by a rotating promotional banner in the page furniture; the Cloud Controls Matrix content itself is identical. I-ISM-2 is captured, and its memento is recorded on the AOS-ISM-2026-001 verification record.
The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to the assessment date. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.
Version history
Three versions. v1.2 corrects one figure in v1.0 and replaces one limitation. A revision does not replace its predecessor: v1.0’s bytes are unchanged, its hash still resolves, and the file remains downloadable at its own address - both are listed below with their hashes. Both versions were assessed and published on 19 August 2026, and the revision keeps v1.0’s SOURCE_DATE_EPOCH, because a revision is not a new reading - it is the same reading, corrected.
| Version | Assessed | Published | SHA-256 | Status |
|---|---|---|---|---|
| v1.0 | 19 August 2026 | 19 August 2026 | 25f58a747e87a81158f7d3fa9e23aab80402cf1431753aa64141fbf299a8a56d | superseded · download |
| v1.1 | 19 August 2026 | 19 August 2026 | d629d892bc1fa68cff587ebe3284ac867b1f2d74e89f2556982c213033d1f354 | superseded · download |
| v1.2 | 19 August 2026 | 20 August 2026 | c6a9275e1d937e54e5b055b5465647d3ebc4dcec8c3e16f009e37385e8c92fe7 | current · download |
The cover carries 19 August 2026, the date the assessment was made. Publication followed on 20 August 2026. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.
Corrections
v1.2, 20 August 2026 - three defects, none touching a finding. All three sat in the apparatus that lets a reader check the findings. A quotation was truncated mid-sentence: the PSPF referral was introduced as “the sentence that follows” and stopped at “Circular 149” with no ellipsis, omitting the circular’s subtitle - Physical security certification of outsourced information and communications technology facilities - and its “(on GovTEAMS)”. The subtitle names a subject that bears on the assessment’s own reliance on that referral, so its omission engaged the corpus rule against eliding a qualification. The full sentence is restored. A statement about what was retrieved had nothing behind it: v1.0 and v1.1 said landing pages “were retrieved” for two NIST catalogues and the Cloud Security Alliance matrix, and no register row, hash, path or retrieval time evidenced it. The three are retrieved and pinned at this revision, and the sentences now say what is pinned. Retrieving them today does not make the earlier sentence true - whether a retrieval happened in early August is not established and is not now establishable - so the earlier assertion is recorded as unevidenced rather than repeated. And a classification had no artefact behind it: NIST SP 800-145 was marked Public in the referral table with no reference, while both not obtainable rows carried their method. Tested on 20 August 2026: HTTP 200, 85,781 bytes, 7 pages. The classification holds, the row now carries a reference, and the count of six referrals - three public, two to one unobtainable document, one not followed - does not move. No finding moves and no claim moves. One quotation is lengthened to the source’s own full stop.
This page’s version history was corrected on 19 August 2026. As first served at v1.1 the lead sentence read “Two versions… v1.0’s bytes are unchanged, its hash still resolves, and the file remains downloadable at its own address” above a table carrying one row. v1.0’s hash appeared nowhere on the page, and neither did a link to it. A reader was told the earlier version could be checked and given nothing to check it with. The table and the count now derive from a single version list, so they cannot disagree. The assessment PDF was not affected and does not reissue; v1.0 remains at its own address with its own hash, both now listed above.
One figure, corrected at v1.1. v1.0 stated that ten further cloud publications listed on the ASD cloud computing page were not read. That page lists eight publications, one of which is examined in the assessment and seven of which were read at this revision. The count was taken from reading the page rather than from counting over it, and was carried into the register row for that page and from there into the assessment. None of the seven specifies a method for assessing foreign legal reach, and the finding is unchanged. The full account and its reach determination are in the practice’s corrections register.
The verification page was separately corrected on 19 August 2026 before this revision: as first published it carried another case’s descriptive text and listed four sources where this assessment relies on eleven. The assessment PDF was not affected by that correction.
The assessment itself has not been corrected since publication. Corrections made before publication are not listed here; they are recorded in the case’s own working files, which are not published.
Corrections made before publication are not listed here. They are recorded in the case’s own scope file, which is where the drafting record belongs. This section exists to hold what changes after a reader could have relied on it, and it will say so plainly if that ever happens.
Assessment PDF
SHA-256: c6a9275e1d937e54e5b055b5465647d3ebc4dcec8c3e16f009e37385e8c92fe7