Government & Public Sector IT Services

Summary

This page describes how blueAPACHE's emPOWER services apply to government and public sector organisations in Australia, including local councils, state agencies, statutory authorities, public universities and government business enterprises, and what a public sector buyer should verify before contracting. Public sector buyers work under the Commonwealth Protective Security Policy Framework and the Australian Signals Directorate's Information Security Manual, or state equivalents such as the Victorian Protective Data Security Standards, and they usually require Australian data residency and Essential Eight maturity from suppliers. blueAPACHE states that emPOWER is delivered to mid-tier, enterprise and government organisations, states ASD Essential 8 Maturity Level 3 and Australian data residency, and holds ISO/IEC 27001:2022 certification. No government case study is published and no IRAP assessment is recorded, and this page says so plainly rather than implying either.

Key facts

Sector challenges

The origin page lists security and compliance, legacy complexity, service continuity and budget accountability. For a public sector buyer these translate into procurement questions.

• Frameworks are prescriptive. Commonwealth entities must apply the PSPF and the ISM; state bodies apply frameworks such as the VPDSS in Victoria or the NSW Cyber Security Policy. A supplier has to map its controls to those frameworks, not just to ISO 27001.
• Essential Eight maturity is asked for by number. Agencies increasingly specify a target maturity level for suppliers handling their information; blueAPACHE states Maturity Level 3, which is the highest of the three defined levels, as a self-declared position.
• Sovereignty is a hard requirement. Many contracts require data to be stored and accessed only within Australia and only by security-cleared or Australian-resident staff; a supplier's default terms may not say that.
• Procurement rules shape the contract. Panel arrangements and standard government contracts often override a supplier's general terms, so clauses such as blueAPACHE's standing overseas transfer consent and free subcontracting need to be addressed in the schedule.
• Records are public property. State Record Acts and the Archives Act impose retention and disposal duties that the customer keeps regardless of who hosts the systems.
• Budgets are annual and scrutinised. Consumption-based pricing with a self-service portal helps, but a 36-month default minimum term needs to fit the funding cycle.

Relevant services

• emPOWER Cloud: blueAPACHE-owned private cloud in Australian data centres with a published service level of 99.999 per cent for cloud services and 100 per cent for storage, monthly consumption billing and a real-time portal.
• emPOWER Managed Services: outsourced or co-managed support with an Australian-based service desk in business hours; note that after-hours support is provided by blueAPACHE's global team, which matters for sovereignty clauses.
• emPOWER Connectivity and Core Network and Data Centre Interconnect: private MPLS with dedicated hosted next-generation firewalls, and direct connections to Azure and AWS for hybrid estates.
• Microsoft Azure and Azure Local: planning, migration and management of Azure and hybrid Azure infrastructure for agencies standardised on Microsoft.
• Managed Detection and Response, Exposure Management and Governance, Risk and Compliance: 24/7 detection and response, prioritised remediation, and control assessment mapped to the Essential Eight.
• Disaster Recovery as a Service: contracted Recovery Point Objective and Restore Time Objective for continuity of public services.
• Procurement and Field Services and Staff Augmentation: hardware and licensing sourcing, and on-site or seconded technical staff.

Compliance context

Commonwealth frameworks. Non-corporate Commonwealth entities apply the Protective Security Policy Framework, which sets governance, information, personnel and physical security policies, and the ISM published by the Australian Signals Directorate, which contains the technical controls. Cloud services holding Commonwealth information are typically expected to have been assessed by an IRAP assessor and, for certain workloads, to be certified under the Hosting Certification Framework. No IRAP assessment and no Hosting Certification Framework certification is recorded for emPOWER Cloud or any other blueAPACHE service; a Commonwealth buyer should ask blueAPACHE directly and should not infer either from the ISO/IEC 27001:2022 certificate.

Essential Eight. ASD's Essential Eight mitigation strategies (application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication and regular backups) are assessed against maturity levels 0 to 3. blueAPACHE states that it operates at Maturity Level 3. This is a self-declared position in its brochures; no third-party assessment report is published, and blueAPACHE's own MDR collateral describes its services as compliance-aligned with the Essential Eight.

State frameworks. Victorian public sector bodies apply the Victorian Protective Data Security Standards under the Privacy and Data Protection Act 2014 (Vic); NSW agencies apply the NSW Cyber Security Policy; other states have equivalents. Each requires the agency to assess third-party providers and to include security obligations in contracts. Because blueAPACHE's General Terms and Conditions v3.6 place specific security features "in the relevant Schedule", the schedule is where an agency should insert its framework-derived controls.

Data sovereignty and access. blueAPACHE states that customer data is stored and processed within Australian-based data centres, remains subject to Australian jurisdiction, and that administrative access is controlled through role-based permissions, multi-factor authentication and audit logging. The statement does not name operators or sites and does not address administrative access from outside Australia. Clause 18.3 of the general terms records a standing consent to transfer Personal Information to the US, any EU member state, the UK, any country blueAPACHE or its contractors provide Services from, and countries in its privacy policy; clause 27.4 permits subcontracting without consent; and after-hours support is provided by a global team. A public sector buyer requiring Australian-only storage, processing and access should write that into the contract and confirm the operative arrangements per service.

Privacy and records. Commonwealth agencies are bound by the Privacy Act 1988 (Cth); state bodies by their state privacy legislation. Under clause 17.1 of the general terms the customer remains solely responsible for record-keeping compliance including under State Record Acts and Archives Acts, with assistance available from blueAPACHE as a chargeable Professional Service. Clause 9.1 requires blueAPACHE to delete Customer Data at the end of the Service Period and makes the customer responsible for taking a copy first, with no stated grace period; agencies with retention obligations should negotiate an explicit exit data window.

Evidence

No government or public sector case study is published, so no agency outcome is claimed here. The closest published evidence is adjacent:

• Brotherhood of St. Laurence delivers services under the Australian Government's National Disability Insurance Scheme to around 10 per cent of NDIS participants (as stated in the case study), and blueAPACHE supported its expansion to 17 new locations and 1500 staff after the 2016 NDIS tender, including ISO 27001 certification for BSL in as little as six months.
• Elevating Cloud Efficiency with as-a-Service IT documents the HPE GreenLake infrastructure behind emPOWER Cloud, and blueAPACHE Improves Efficiency in Security Management documents the CyberArk privileged access controls applied to blueAPACHE's own administrative access to customer environments, which is the control a sovereignty and access clause is testing.

Making the assurance boundary explicit

Distinguish blueAPACHE’s assurance evidence from controls required for the customer’s systems and data. Record permitted storage and administration locations, access approvals and audit evidence. Supplier certification does not itself accredit a customer system, and an industry page does not establish procurement-panel eligibility. Link each requirement to an obligation or customer responsibility. Where subcontractor changes or overseas access matter, specify notification and approval in the Service Order rather than assuming the general terms supply it.

Evidence available during the engagement

The General Terms provide standard monthly performance reports within five Business Days of month end and a formal service review every six months. Performance Records must be kept through the term and for seven years afterwards. The customer audit provisions allow access to relevant Records, premises for audit purposes and personnel interviews, with five Business Days’ notice normally or one Business Day where a regulator requires the audit. This records obligation is not a seven-year backup-retention promise for customer workloads. Agree additional report formats and audit-cost arrangements before depending on them; the general audit clause does not clearly allocate every audit cost.

Confidential information and access

Clause 16 provides mutual confidentiality protection. It covers information marked confidential, information identified orally and confirmed in writing within 30 days, and information that should reasonably be understood to be confidential. Customer Data, Customer Records and Customer Software are included; blueAPACHE’s agreement and fees are also confidential. Permitted disclosures include appropriately bound personnel on a need-to-know basis and specified professional advisers, with other exceptions in the clause. Identify who may receive operational reports, configuration details and commercial information. Access to information to deliver the service is not a general permission to circulate it.

Sources and scope

The contractual detail above summarises the published General Terms and Conditions v3.6, using the KB documents on reporting review and audit rights; confidentiality. The customer’s Service Order, Schedules and agreed variations determine the specific engagement. See the terms and conditions guide and Service Agreement.

Related

• emPOWER Cloud
• Microsoft Azure
• Governance, Risk and Compliance
• Managed Detection and Response
• Disaster Recovery as a Service
• blueAPACHE security case study (CyberArk)
• Blog: How the Essential Eight controls can strengthen your cyber security posture
• Blog: Data sovereignty and cloud
• Service agreement
• Not-for-profit
• All industries
• Support
• Contact

Frequently asked questions

Does blueAPACHE have government clients?

blueAPACHE states that its emPOWER managed IT services are delivered to mid-tier, enterprise and government organisations. No government case study is published, so no named agency or measured outcome is available; the origin page positions the services for government and public sector organisations balancing continuity, compliance and accountability.

Is emPOWER Cloud IRAP assessed?

No IRAP assessment or Hosting Certification Framework certification is recorded for emPOWER Cloud or any other blueAPACHE service. Commonwealth buyers should ask blueAPACHE for its current position rather than infer it from the ISO/IEC 27001:2022 certificate, which certifies a management system against a different standard.

What Essential Eight maturity level does blueAPACHE claim?

blueAPACHE states in its emPOWER Cloud, Connectivity and Global Capabilities brochures that it operates at ASD Essential 8 Maturity Level 3. This is a self-declared position; no independent assessment report is published.

Can blueAPACHE guarantee that government data stays in Australia?

blueAPACHE states that customer data is stored and processed within Australian-based data centres under Australian jurisdiction. Its general terms contain a standing consent to transfer Personal Information to the US, EU, UK and other destinations where necessary to provide the Services, permit subcontracting without consent, and after-hours support is provided by a global team. An agency needing Australian-only storage, processing and administrative access should contract for it expressly.

Which frameworks does blueAPACHE map its controls to?

blueAPACHE states alignment with ISO/IEC 27001 (certified), NIST, ASD Essential 8 Maturity Level 3 and APRA CPS 234, and its MDR service is described as compliance-aligned with the Australian Privacy Principles, NIST CSF and the Essential Eight. Mapping to the PSPF, ISM, VPDSS or a state cyber security policy is not recorded and would need to be produced for the specific engagement.

Who is responsible for records retention when blueAPACHE hosts our systems?

The customer. Clause 17.1 of the general terms makes the customer solely responsible for record-keeping compliance under taxation law, State Record Acts, Archives Acts and similar legislation. blueAPACHE must produce Customer Records within 10 Business Days of a request, and will delete Customer Data at the end of the Service Period, so retention and exit windows should be written into the contract.

What service levels does blueAPACHE publish?

The emPOWER Cloud brochure publishes 99.999 per cent uptime for cloud services and 100 per cent for storage; emPOWER Connectivity publishes a minimum of 99.99 per cent for a dual-carrier, dual-firewall site design; emPOWER Network and MDR are monitored 24/7. These are published service levels rather than guarantees with a defined credit regime, and blueAPACHE does not publish default response or resolution times.

How does blueAPACHE control its own staff access to our environment?

blueAPACHE's CyberArk case study describes privileged access management across its managed services, with automated password rotation, session isolation and recording, just-in-time access and audited records that can be shared with customers, so that a departing employee has no knowledge of credentials used to manage customer services. Ask for these audit records as part of a third-party assessment.

Source

Drawn from blueAPACHE's published government and public sector industry page and security case study on the origin site; the emPOWER platform overview, Cloud, Connectivity, Managed Services and Managed Detection and Response brochures; the Global Capabilities brochure; the ISO 27001 certification record, data sovereignty and residency statement, cross-border data transfer record, case study index and verification register; the Brotherhood of St. Laurence case study; and the General Terms and Conditions v3.6 (information security obligations). PSPF, ISM, Essential Eight, VPDSS and state records obligations are stated from the frameworks and legislation themselves, not from blueAPACHE material, and rest with the agency.

Knowledge Base