Secure Remote Access Environment (SRAE)

• AIHW has invested heavily in several online environments which include Microsoft Azure and AWS.

• AWS is one of the preferred providers due to its availability and maturity of services that would allow AIHW to expand and scale the organisations business needs on demand. 
• AWS is also security certified by the Australian Cyber Security Centre (ACSC) to house data classifications of unclassified, official: sensitive and protected. 
• The Digital Transformation Agency (DTA) has established a whole-of-government volume sourcing which will give AIHW value for money and premium support agreements.

 
For more information on the whole of agreement see A new whole-of-government volume sourcing agreement has been established with Amazon Web Services (AWS).

For more information on data classification see ASD certified cloud services. 

Yes - the data that is stored in AWS is a secure environment and the data centre is located in Sydney Australia which is bound by Australian data sovereignty laws. AIHW has implemented multiple security controls to ensure the data is safe and consistently monitored (see below). 

AWS is certified by the Australian Cyber Security Centre to house data up to protected and obtained security re-certification (iRAP) as of January 2020. 

Many other government agencies currently housing their applications and information on AWS platforms including:

• Australian Bureau of Statistics 
• Digital Earth Australia 
• Digital Transformation Agency 
• Intellectual Property Australia 

AAntivirus and malware scanning: all files that interact with applications are scanned for malicious code before entering the environment. 

Governance controls:

• users need to undergo ethics approval or require formal approval from the data custodians before gaining access to the project
• all incoming and outgoing files are reviewed and require approval from data controllers before being moved to/from the environment
• a dedicated AIHW service-desk has been established to provide user support
• data at rest is encrypted.

Secure environments like SRAE are becoming increasingly common, other government and universities such as the ABS datalab and the Sax Institute are developing analogous environments. All have differing capabilities and governance requirements. For example the ABS datalab have government mandated requirements that they maintain ownership of any data that exists in their systems.

SRAE has a policy where data access is defined by the data owner. Users are free to bring in any data they need and egress any data that is in line with their defined governance requirements and practices.