The letter
Subject: ASD Essentials for cloud: defining “sovereignty requirements” (GOV-11)
From: Brunel Al-Bijwaie <brunel@australiaos.com.au>
To: asd.essentials
Sent: Saturday 17 October 2026, 20:49
Dear Essentials team,
I am the director of AustraliaOS Pty Ltd, an independent practice in Melbourne. It assesses whether a technology provider can be compelled under foreign law to give access to data. I am writing about one Action in ASD Essentials for cloud.
Disclosure first. AustraliaOS has published documents that assess ASD publications: AOS-ISM-2026-001 and AOS-ICL-2026-001, on the ISM’s procurement chapter, and AOS-ASR-2026-001, AOS-AAH-2026-001, AOS-ACD-2026-001 and two supplements to AOS-AIDC-2026-001. AOS-TSC-2026-001 examines the Top Secret Cloud, to which ASD is a party. None assesses the Essentials. AustraliaOS sells assessments of the third element proposed below, so I have a commercial interest in it. All are at australiaos.com.au/cases.
The Action. Under GOV-11 Supplier cyber security assurance, the cloud chapter asks organisations to “Establish policies that meet your data sensitivity and sovereignty requirements” (p 12). That is the only use of “sovereign” in the three chapters and fourteen supporting PDFs. The glossary has no entry for it and the FAQ does not mention it. “Foreign” and “jurisdiction” appear in none of the seventeen. The nearest wording is about location: an IRAP assessment scoped to the “regions” consumed (p 6), records of “cloud regions” (IDE-01, p 14), and “the regions in which AI processing occurs” (AI considerations, p 8). Because the test is “your … requirements”, a policy that covers only where data is stored can meet the Action as written.
Why location is not enough. Each chapter says its principles are “drawn from ASD’s Information Security Manual (ISM)”. The ISM’s Guidelines for procurement and outsourcing state that “foreign-owned suppliers operating in Australia may be subject to a foreign government’s lawful access to data belonging to their customers” (September 2026). The Hosting Certification Framework defines the term directly: “For clarity, sovereignty refers to the ability of the government to specify and maintain stringent ownership and control conditions” (March 2021, version 2, p 1). Ownership and control still leave one question open. United States law reaches data in a provider’s “possession, custody, or control, regardless of whether” it is located within or outside the United States (18 USC 2713). Usually that is the company that owns the service. When a supplier holds the data or the administrator access, it may not be.
Proposed glossary entry
sovereignty requirements: An organisation’s requirements for:
(a) location: where its data is stored and processed;
(b) ownership and control: who owns and controls each provider or supplier that holds the data or administrator access to it, assessed against the Hosting Certification Framework where it applies; and
(c) legal reach: which governments can lawfully compel any of those parties to give access to the data.
The three elements are based on an outline by Alan Howard (Sentari-AI), a cyber and AI governance specialist, of what a board’s sovereignty policy should cover. The wording and the HCF reference are mine.
Two requests. First, add the entry, and point the GOV-11 Action to it and to the Hosting Certification Framework. Second, carry the same definition into the guidance on assessing suppliers that the Assessment process guide says ASD will provide (p 3).
I can send the passages and sources behind each statement. I plan to publish this letter once you have had it for two weeks. I will not publish any reply without your agreement.
Regards,
Brunel Al-Bijwaie
Director, AustraliaOS Pty Ltd
australiaos.com.au