Verification chain
Four things are pinned, and each can be checked independently of the others.
The assessment PDF. SHA-256: 3136bd770cc44f32da3ceaec48431f84bd32efbf6c3fde04165d16d996d4cf7a
Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.
The timestamp. The receipt AOS-HCD-2026-001-v1.0.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 28 August 2026 and pending confirmation in the Bitcoin blockchain at publication. It has since been anchored: the receipt served here carries three Bitcoin attestations. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.
The assessed source. The assessment rests on 25 pinned artefacts: 20 retrieved and pinned by this case, and 5 inherited under convention 7 from other cases in this corpus, each re-verified against its recorded hash before this record was written. All 25 are pinned by hash and 7 of the 25 are themselves Internet Archive captures. Quotations were checked against page images, not against a text layer alone; vocabulary counts state the artefact they were taken from and the control word run on the same extraction.
| Ref | Artefact | SHA-256 | Third-party copy |
|---|---|---|---|
| R-HA-1 | Department of Home Affairs, Commonwealth Cyber Security Policy Consultation Package page, as served 28 August 2026 | 6a51460aafff27feeb74fcc71ffbdb02c67192ca906e9f7644a38a98d4566310 | - |
| R-HA-2 | Department of Home Affairs, Commonwealth Cyber Security Uplift address, as served 28 August 2026 | 4679c589113f443b766ab57712ce7ebd71ef07ae5cfc77cb30ae80dc616a8a86 | - |
| R-HA-3 | Department of Home Affairs, Hosting Certification Framework Invitation to Consultation, July 2025, 5 pages, OFFICIAL | cfa5acdd427c77114171fc59abdc0e03de62ec5c8f38590fe41caeaeab299741 | - |
| R-HA-4 | Department of Home Affairs, consultations listing page, as served 28 August 2026 | df7308887197c232b2325a4d9d980734811ce599b381b0bcf23faf6bbaac31f1 | - |
| R-HA-5 | Department of Home Affairs, news and media archive, as served 28 August 2026 | 280c4db6e2fca037bbb64bfddf91414c41c89c18dc813abf51b7835f20b40e2b | - |
| R-HA-6 | Department of Home Affairs, Cyber Security portfolio page, as served 28 August 2026 | 4f730a0b21bce9975a27e7c3fdfd7d75ca058183d2037d5c86f8c88c012bf145 | - |
| R-HCF-1 | Hosting Certification Framework, home page, as served 28 August 2026 | 167bb15310fb43230a87ea1c22c16d37ab72e056227c1bf650e7b9dcab2ac958 | - |
| R-HCF-2 | Hosting Certification Framework, Framework page, as served 28 August 2026 | 0d4e2bda60070e3acd30d8bcf2cc116f8690988f9020468488a56f826c948f92 | - |
| R-HCF-3 | Hosting Certification Framework, For Service Providers page, as served 28 August 2026 | 6f45c03cc8c141b42253dd0ed855a576e6ef8897602d2e41a49c47ff008fe2b3 | - |
| R-HCF-4 | Hosting Certification Framework, Resources page, as served 28 August 2026 | 8a5c8d843c19ffbddab923a270f429927bb6a1dd0dd65890707f6f5a17171ede | - |
| R-HCF-5 | Hosting Certification Framework, certified-provider register, as served 28 August 2026 | e070a389729ffff7f930fba91386b032905cce7d1c5e03e2a4d4c5bdd100fd98 | - |
| R-DEED-1 | HCF Deed of Certification (Template), 20 pages, Official: Sensitive Legal - Privilege, as served 28 August 2026 | 3b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2f | - |
| R-FW-1 | Hosting Certification Framework, March 2021 v2, 30 pages, as served 28 August 2026 | 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070 | - |
| R-IA-20260106 | Internet Archive capture of the Home Affairs consultation package page, 6 January 2026 04:13:34 UTC | b38e15e5ee8f2fd8e653a3b52707ca246dd685d4ba0ae7288b0e167268fad421 | Internet Archive replay |
| R-IA-CDX | Internet Archive CDX index for the Home Affairs consultation package page, collapse=digest | 06f4235e0603da666bb0ab5a736ba3c1217438e90aeccdb1d86d4c3d2e792c71 | Internet Archive replay |
| R-HA-7 | Department of Home Affairs, Guiding Principles to embed Zero Trust Culture, Consultation Paper, November 2024, 11 pages, OFFICIAL, DRAFT - FOR DISCUSSION ONLY | 6e0c5d36574d367416a383ca3b05853db6aca7740119ea2576e28cd7364f7405 | - |
| R-HA-8 | Department of Home Affairs, Australian Government Gateway Security Standard Consultation Paper, February 2025, 24 pages, OFFICIAL | e25da5f25b60cbb220853bd5ad8ed81762110bb39655e3e687b6d168c02e31a9 | - |
| R-HA-9 | Department of Home Affairs, How to engage us page, as served 28 August 2026 | 5bc7f11fb04e0821bad6dc468a398bba7eb73eeb7392d9b705a7522f2992c22f | - |
| R-IA-CDX-DEED | Internet Archive CDX index for the Deed of Certification's own address, all rows, fl=timestamp,statuscode,digest,mimetype,length | 2f6bab3ece5c3f261f93ec837bd3a7717b514aaef1313c3100d1dbfe8899f6da | Internet Archive replay |
| R-IA-20220307043937 | Internet Archive capture of the HCF Deed of Certification (Template) at its own address, 7 March 2022 04:39:37 UTC, raw id_ replay, 20 pages, 715,777 bytes | 3b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2f | Internet Archive replay |
| A-DEED-1 | Hosting Certification Framework, Deed of Certification (Template), 20 pages [INHERITED CAPTURE, convention 7] Retrieved under assurance-method-gap-2026-08 on 2026-08-24T05:46:43Z and re-verified against its recorded hash on 2026-09-03. The blob is held in that case; this row records the re-verification and is excluded from this case stated capture window | 3b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2f | - |
| A-WB-3 | Internet Archive capture of the Home Affairs Commonwealth Cyber Security Policy Consultation Package page, 22 April 2026 12:02:55 UTC, raw id_ replay [INHERITED CAPTURE, convention 7] Retrieved under hosting-exemption-followon-2026-08 on 2026-08-12T13:17:40Z and re-verified against its recorded hash on 2026-09-03. The blob is held in that case; this row records the re-verification and is excluded from this case stated capture window | 24677a212ad6675c8d8ff844c2be0a1d4e31e0300078f499d88a5abf9a5d1b4d | Internet Archive replay |
| F-IA-20211126005423 | Hosting Certification Framework, March 2021 v2, Internet Archive capture of the document own address, 26 November 2021 00:54:23 UTC, raw id_ replay [INHERITED CAPTURE, convention 7] Retrieved under general-findings/hcf-framework-availability-2026-08 on 2026-08-27T07:25:23Z and re-verified against its recorded hash on 2026-09-03. The blob is held in that case; this row records the re-verification and is excluded from this case stated capture window | 7b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070 | Internet Archive replay |
| F-IA-CDX | Internet Archive CDX index for the framework document own address, fl=timestamp,statuscode,digest,mimetype,length [INHERITED CAPTURE, convention 7] Retrieved under general-findings/hcf-framework-availability-2026-08 on 2026-08-27T07:23:59Z and re-verified against its recorded hash on 2026-09-03. The blob is held in that case; this row records the re-verification and is excluded from this case stated capture window | e280383aa4782e9fe28e4cf3b387cb82004ca8ebbcb43093c45299e661e811fe | Internet Archive replay |
| L-PSPF-3 | Protective Security Policy Framework, Release 2026 List of Requirements, publication date 1 July 2026 [INHERITED CAPTURE, convention 7] Retrieved under compellability-landscape-2026-08 on 2026-08-11T08:09:38Z and re-verified against its recorded hash on 2026-09-03. The blob is held in that case; this row records the re-verification and is excluded from this case stated capture window | be1eb1cece9d8096b07740c8a9ef8cd750b29c43ae9954f07cedf09a14542945 | - |
Of the 25 pinned artefacts, 7 are themselves third-party archive captures - R-IA-20260106, R-IA-CDX, R-IA-CDX-DEED, R-IA-20220307043937, A-WB-3, F-IA-20211126005423, F-IA-CDX - retrieved from the Internet Archive rather than from a publisher, and a reader can re-fetch each of those from that archive at the address the register records. The other 18 were retrieved from the publisher, and no independent capture of them is pinned here; for those 18 a reader must rely on this site or on the publisher’s server.
The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to midnight UTC of 28 August 2026, the publication day, which does not move at any revision. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.
Version history
One version. The assessment date and the publication date are both recorded, and here they are the same day.
| Version | Assessed | Published | SHA-256 | Status |
|---|---|---|---|---|
| v1.0 | 28 August 2026 | 28 August 2026 | 3136bd770cc44f32da3ceaec48431f84bd32efbf6c3fde04165d16d996d4cf7a | current · download |
The cover carries 28 August 2026, the date the assessment was made, and publication followed the same day. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.
Corrections
None. This is the first edition and it has not been corrected since publication. Any correction to this assessment will be recorded here and in the practice’s corrections register, and the published bytes of this version will not move.
Corrections made before publication are not listed here. They are recorded in the case’s own pre-insertion audit and pre-publication audit, which are tracked with the source.
Assessment PDF
SHA-256: 3136bd770cc44f32da3ceaec48431f84bd32efbf6c3fde04165d16d996d4cf7a