Verification Record
AOS-HCD-2026-001 · v1.0

What the Consultation Publishes

An assessment of what one Home Affairs consultation package publishes. The package puts three documents to consultation. Two of the three papers contain the document being consulted on. The third, for the Hosting Certification Framework 2 Policy, directs the reader to email for a copy, from the address that receives submissions. The page states the consultation is open to all members of the public and closes on a date thirteen months before the day it was read; the Deed of Certification is named as a later phase, with no consultation described in anything retrieved. This is not a finding that the department withheld anything: a document supplied on request from a published address is available. No retrieved artefact records a decision, and none is assessed.

Reference
AOS-HCD-2026-001
Assessed
28 August 2026
Version
v1.0
The chain

Verification chain

Four things are pinned, and each can be checked independently of the others.

The assessment PDF. SHA-256: 3136bd770cc44f32da3ceaec48431f84bd32efbf6c3fde04165d16d996d4cf7a

Download the file and run shasum -a 256 over it. If the value differs, the file is not the one struck here.

The timestamp. The receipt AOS-HCD-2026-001-v1.0.pdf.ots is an OpenTimestamps proof over exactly those bytes, submitted to four calendars on 28 August 2026 and pending confirmation in the Bitcoin blockchain at the time of publication. It establishes that the file existed no later than the moment it was stamped. It establishes nothing about whether the file is correct.

Receipt SHA-256: 5fc8137e77629ce6ff6a1f2fefe9e4b76c5f3d2c96be81d00c71b40df1aef0ae

The assessed source. The assessment rests on 20 pinned artefacts: all 20 retrieved and pinned by this case. All 20 are pinned by hash and 4 of the 20 are themselves Internet Archive captures. Quotations were checked against page images, not against a text layer alone; vocabulary counts state the artefact they were taken from and the control word run on the same extraction.

RefArtefactSHA-256Third-party copy
R-HA-1Department of Home Affairs, Commonwealth Cyber Security Policy Consultation Package page, as served 28 August 20266a51460aafff27feeb74fcc71ffbdb02c67192ca906e9f7644a38a98d4566310-
R-HA-2Department of Home Affairs, Commonwealth Cyber Security Uplift address, as served 28 August 20264679c589113f443b766ab57712ce7ebd71ef07ae5cfc77cb30ae80dc616a8a86-
R-HA-3Department of Home Affairs, Hosting Certification Framework Invitation to Consultation, July 2025, 5 pages, OFFICIALcfa5acdd427c77114171fc59abdc0e03de62ec5c8f38590fe41caeaeab299741-
R-HA-4Department of Home Affairs, consultations listing page, as served 28 August 2026df7308887197c232b2325a4d9d980734811ce599b381b0bcf23faf6bbaac31f1-
R-HA-5Department of Home Affairs, news and media archive, as served 28 August 2026280c4db6e2fca037bbb64bfddf91414c41c89c18dc813abf51b7835f20b40e2b-
R-HA-6Department of Home Affairs, Cyber Security portfolio page, as served 28 August 20264f730a0b21bce9975a27e7c3fdfd7d75ca058183d2037d5c86f8c88c012bf145-
R-HCF-1Hosting Certification Framework, home page, as served 28 August 2026167bb15310fb43230a87ea1c22c16d37ab72e056227c1bf650e7b9dcab2ac958-
R-HCF-2Hosting Certification Framework, Framework page, as served 28 August 20260d4e2bda60070e3acd30d8bcf2cc116f8690988f9020468488a56f826c948f92-
R-HCF-3Hosting Certification Framework, For Service Providers page, as served 28 August 20266f45c03cc8c141b42253dd0ed855a576e6ef8897602d2e41a49c47ff008fe2b3-
R-HCF-4Hosting Certification Framework, Resources page, as served 28 August 20268a5c8d843c19ffbddab923a270f429927bb6a1dd0dd65890707f6f5a17171ede-
R-HCF-5Hosting Certification Framework, certified-provider register, as served 28 August 2026e070a389729ffff7f930fba91386b032905cce7d1c5e03e2a4d4c5bdd100fd98-
R-DEED-1HCF Deed of Certification (Template), 20 pages, Official: Sensitive Legal - Privilege, as served 28 August 20263b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2f-
R-FW-1Hosting Certification Framework, March 2021 v2, 30 pages, as served 28 August 20267b654f6e435bb90560701bf5e4905538f2da0cae73157ab4d58e710045855070-
R-IA-20260106Internet Archive capture of the Home Affairs consultation package page, 6 January 2026 04:13:34 UTCb38e15e5ee8f2fd8e653a3b52707ca246dd685d4ba0ae7288b0e167268fad421Internet Archive replay
R-IA-CDXInternet Archive CDX index for the Home Affairs consultation package page, collapse=digest06f4235e0603da666bb0ab5a736ba3c1217438e90aeccdb1d86d4c3d2e792c71Internet Archive replay
R-HA-7Department of Home Affairs, Guiding Principles to embed Zero Trust Culture, Consultation Paper, November 2024, 11 pages, OFFICIAL, DRAFT - FOR DISCUSSION ONLY6e0c5d36574d367416a383ca3b05853db6aca7740119ea2576e28cd7364f7405-
R-HA-8Department of Home Affairs, Australian Government Gateway Security Standard Consultation Paper, February 2025, 24 pages, OFFICIALe25da5f25b60cbb220853bd5ad8ed81762110bb39655e3e687b6d168c02e31a9-
R-HA-9Department of Home Affairs, How to engage us page, as served 28 August 20265bc7f11fb04e0821bad6dc468a398bba7eb73eeb7392d9b705a7522f2992c22f-
R-IA-CDX-DEEDInternet Archive CDX index for the Deed of Certification's own address, all rows, fl=timestamp,statuscode,digest,mimetype,length2f6bab3ece5c3f261f93ec837bd3a7717b514aaef1313c3100d1dbfe8899f6daInternet Archive replay
R-IA-20220307043937Internet Archive capture of the HCF Deed of Certification (Template) at its own address, 7 March 2022 04:39:37 UTC, raw id_ replay, 20 pages, 715,777 bytes3b7f03819a27aae5550b8ce5a434bea2e29b36806d44729d4cd25e79dd101a2fInternet Archive replay

Of the 20 pinned artefacts, 4 are themselves third-party archive captures - R-IA-20260106, R-IA-CDX, R-IA-CDX-DEED, R-IA-20220307043937 - retrieved from the Internet Archive rather than from a publisher, and a reader can re-fetch each of those from that archive at the address the register records. The other 16 were retrieved from the publisher, and no independent capture of them is pinned here; for those 16 a reader must rely on this site or on the publisher’s server.

The build. The PDF is produced deterministically from tracked source by build.sh, with SOURCE_DATE_EPOCH pinned to the assessment date. Repeat builds on one machine and one toolchain are byte-identical; independent third-party reproducibility is not established and is not claimed. Verify by SHA-256, not by rebuild.

Versions

Version history

One version. The assessment date and the publication date are both recorded, and here they are the same day.

VersionAssessedPublishedSHA-256Status
v1.028 August 202628 August 20263136bd770cc44f32da3ceaec48431f84bd32efbf6c3fde04165d16d996d4cf7acurrent · download

The cover carries 28 August 2026, the date the assessment was made, and publication followed the same day. An assessment is a reading of a source at a moment, and the document’s retrieval times and viewed dates already fix that moment; the cover is not moved to the upload date, because that would put two dates on one act of reading.

Corrections

Corrections

None. This is the first edition and it has not been corrected since publication. Any correction to this assessment will be recorded here and in the practice’s corrections register, and the published bytes of this version will not move.

Corrections made before publication are not listed here. They are recorded in the case’s own pre-insertion audit and pre-publication audit, which are tracked with the source.

Download

Assessment PDF

AOS-HCD-2026-001-v1.0.pdf · 137,638 bytes · 11 pages

SHA-256: 3136bd770cc44f32da3ceaec48431f84bd32efbf6c3fde04165d16d996d4cf7a

OpenTimestamps receipt