Vault Cloud Sovereign Defence Security (SDS): 2026 Technical & Architecture Overview

Vault Cloud’s Sovereign Defence Security (SDS) provides Australian Defence, national security agencies, and defence industry suppliers with an Australian-owned, IRAP-assessed cloud platform built strictly within national borders. Designed to satisfy the Australian Signals Directorate (ASD) Information Security Manual (ISM) and Defence Industry Security Program (DISP) mandates, SDS protects sensitive military, intelligence, and sovereign data from extraterritorial legal reach and foreign cyber threats.

What is Vault Cloud Sovereign Defence Security (SDS)?

Vault Cloud Sovereign Defence Security (SDS) is an enterprise cloud architecture engineered specifically for the stringent security, legal, and operational requirements of the Australian Defence Department, government agencies, and the broader Defence supply chain. Unlike global hyperscale cloud providers operating under foreign parent companies, Vault Cloud is 100% Australian-owned, operated, and funded. This structural independence guarantees that all data hosted within SDS remains entirely under Australian legal jurisdiction, free from foreign subpoenas, regulatory overreach, or extraterritorial legislation such as the United States Clarifying Lawful Overseas Use of Data (CLOUD) Act.

The SDS framework encompasses Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), sovereign Kubernetes orchestration, and high-performance Object/Block storage. It operates across secure Australian data centers located in primary government nodes, including Canberra, Sydney, and Melbourne. Every aspect of the platform—from physical datacenters and network hardware to hypervisors and storage arrays—is administered exclusively by Australian citizens holding high-level national security clearances, including Negative Vetting Level 1 (NV1), Negative Vetting Level 2 (NV2), and Positive Vetting (PV).

In the contemporary geopolitical landscape, sovereign data security is no longer merely a matter of storing data inside a physical border. True digital sovereignty requires absolute autonomy over the underlying hardware, firmware, supply chain, system administration, and software stack. Vault Cloud SDS addresses this imperative by building its platform on open-source OpenStack technology, eliminating proprietary vendor lock-in and ensuring complete auditability of system source code and operational workflows.

Core Architecture and Technical Security Controls

Vault Cloud SDS is architected according to a zero-trust security paradigm, ensuring that physical isolation, cryptographic segregation, and identity-bound access controls operate in unison across all compute, storage, and networking layers.

• Vault Cloud SDS Architecture
  • Identity & Access (Zero Trust / NV Cleared Personnel)
  • Sovereign Compute (OpenStack KVM)
  • Sovereign K8s (Container Engine)
  • S3 Object Store (Ceph Storage)
  • Hardware Security Modules (FIPS 140-3 Level 3 HSM) / BYOK
  • Cryptographic Isolation / Hardware Enclaves / AES-256 GCM
  • Onshore Physical Infrastructure (Canberra / Sydney / Melb)

1. Cryptographic Isolation and Key Management

Data security within Vault Cloud SDS is grounded in mandatory end-to-end encryption. All data at rest across block, object, and ephemerally mounted storage volumes is encrypted using AES-256 GCM algorithms.

• Hardware Security Modules (HSMs): Key generation and storage leverage dedicated FIPS 140-3 Level 3 validated Hardware Security Modules.
• Bring Your Own Key (BYOK) & Hold Your Own Key (HYOK): Defence customers retain exclusive ownership of root cryptographic keys. Vault Cloud engineers and system automated scripts have no structural ability to decrypt customer data payloads.
• Quantum-Resistant Encryption Preparedness: In response to modern cryptographic standards, SDS incorporates post-quantum cryptographic key exchange options for secure site-to-site tunnels and data transport pipelines.

2. Network Segregation and Transport Security

Vault Cloud SDS enforces strict micro-segmentation at the software-defined networking (SDN) layer. Network traffic between tenant workloads, virtual data centers, and external endpoints is routed through dedicated virtual routers with integrated stateful firewalls, intrusion detection, and prevention systems (IDS/IPS).

• Direct Connectivity Options: SDS supports direct physical cross-connects to the Intra-Government Communications Network (ICON), Megaport, and dedicated point-to-point fibre networks, completely bypassing the public internet for sensitive defence transmissions.
• In-Transit Encryption: All inter-node cluster communications and remote administration sessions use TLS 1.3 with strict cipher suite enforcement and SSH with public-key infrastructure (PKI) tied to hardware tokens (e.g., YubiKeys).

3. OpenStack Sovereign Foundation

By deploying an enterprise-grade, hardened implementation of OpenStack, Vault Cloud avoids proprietary hypervisors and closed-source software components that present supply-chain risks. The OpenStack hypervisors utilize Kernel-based Virtual Machine (KVM) technology with hardware-assisted virtualization (Intel VT-x / AMD-V) and sVirt isolation, preventing virtual machine escape vectors and cross-tenant memory leakage.

Compliance Frameworks and Defence Accreditation

Vault Cloud SDS is engineered from the physical layer up to satisfy the regulatory and technical mandates set by the Australian Government and International Standards Bodies.

• Compliance Matrix Overview
  • ASD ISM Controls (PROTECTED/High)
  • DISP Membership (Levels 1 to 3)
  • PSPF Standards (Physical/Gov)
  • ISO 27001 / ISO 27017 / ISO 27018 / SOC 2 Type II Certified

Australian Signals Directorate (ASD) ISM & IRAP

The Australian Signals Directorate Information Security Manual (ISM) outlines the cyber security framework that Australian government agencies and contractors must execute. Vault Cloud SDS undergoes independent assessment by accredited Information Security Registered Assessors Program (IRAP) practitioners.

• PROTECTED Classification: Vault Cloud SDS is fully IRAP-assessed to store and process data up to the PROTECTED classification level.
• High-Classification Systems: For custom, single-tenant private enclaves, Vault Cloud designs infrastructure aligned with specialized security requirements beyond standard public cloud offerings, supporting national security workloads.

Defence Industry Security Program (DISP)

Under the Defence Industry Security Program (DISP) administered by the Defence Security Division, businesses operating within the Defence supply chain must maintain accredited governance, personnel, physical, and cyber security standards. Vault Cloud’s SDS environments serve as a pre-compliant digital platform for DISP-accredited entities, allowing Defence Primes and SMEs to fulfill their DISP Cyber Security requirements without managing baseline physical infrastructure.

Governance and Standards Summary

Vault Cloud SDS maintains comprehensive third-party certifications across global and national standards:

Comparison: Vault Cloud SDS vs. Foreign Hyperscaler Sovereign Offerings

When evaluating sovereign cloud platforms, organizations must distinguish between sovereignty-in-region (data stored locally by a foreign multinational) and true structural sovereignty (data owned, hosted, and operated exclusively under local jurisdiction).

Primary Use Cases in Defence and National Security

Vault Cloud SDS caters directly to strategic initiatives across the Australian Defence Organisation (ADO), Defence Science and Technology Group (DSTG), Defence Primes, and intelligence partner networks.

• Primary SDS Defence Use Cases
  1. Supply Chain (DISP SMEs & Defence Primes)
  2. C4ISR & Edge Telemetry Processing
  3. Secure AI & Sovereign Analytics Workloads

1. Defence Supply Chain and DISP SME Hosting

Defence contractors, engineering firms, and software vendors bidding on Department of Defence tenders are required to store tender data, CAD models, software source code, and contract documentation on ISM-compliant infrastructure. SDS provides pre-configured, DISP-aligned virtual datacenters where small-to-medium enterprises (SMEs) can immediately store technical data under PROTECTED standards without investing millions in physical server rooms.

2. C4ISR and Tactical Data Processing

Command, Control, Communications, Computers, Intelligence, Surveillance, and Reconnaissance (C4ISR) systems generate massive volumes of sensor telemetry, geospatial imaging, and real-time intelligence feeds. Vault Cloud SDS delivers high-throughput block and object storage with low-latency compute pools, allowing analytical teams to ingest, process, and disseminate operational data across secure networks efficiently.

3. Sovereign AI and High-Performance Computing (HPC)

Modern defence applications rely heavily on advanced machine learning algorithms for automated target recognition, predictive maintenance, and strategic simulation. Vault Cloud SDS offers GPU-accelerated sovereign compute instances. Because these AI models run entirely on Australian sovereign infrastructure, classified training datasets and proprietary military algorithms remain securely guarded against unauthorized exfiltration or third-party training ingestion.

Step-by-Step Technical Onboarding and Deployment Guide

Deploying workloads onto Vault Cloud SDS follows a structured framework aligned with ASD guidance and enterprise governance standards.

1. Step 1: Governance & Data Categorization
2. Step 2: Network Connectivity Setup (ICON/Direct Connect)
3. Step 3: Identity & Access Control Integration (NV Cleared Access)
4. Step 4: Provisioning Compute & Sovereign Storage
5. Step 5: Continuous Monitoring & Incident Response Integration

Step 1: Governance and Data Categorization

Before deploying infrastructure, define your organization's security boundary and data classification level:

1. Conduct a data inventory to isolate UNCLASSIFIED, OFFICIAL: Sensitive, and PROTECTED assets.
2. Determine your DISP membership tier requirement (e.g., Level 1, 2, or 3) based on contract deliverables.
3. Establish your cryptographic requirements, including root key generation protocols and hardware key storage policies.

Step 2: Architecture Design and Network Provisioning

Establish secure physical and logical network links to the Vault Cloud environment:

1. Provision redundant private network connections via Megaport, direct cross-connect, or ICON for direct government communication.
2. Configure OpenStack Neutron software-defined virtual private clouds (VPCs), setting up internal subnets, custom routing tables, and perimeter firewall policies.
3. Establish IPsec VPN tunnels with AES-256-GCM encryption for backup administrative access.

Step 3: Identity and Access Management (IAM) Integration

Implement multi-factor authentication and role-based access control (RBAC):

1. Integrate your enterprise Identity Provider (IdP) using SAML 2.0 or OpenID Connect (OIDC) with mandatory Hardware Security Key MFA (FIDO2/WebAuthn).
2. Define access policies adhering to the principle of least privilege, ensuring only cleared personnel with a documented "need-to-know" possess administrative roles.
3. Configure administrative audit logging, sending immutable system events to a centralized, air-gapped security information and event management (SIEM) instance.

Step 4: Infrastructure Provisioning via Infrastructure-as-Code (IaC)

Utilize standardized OpenStack APIs and automation tools to instantiate resources:

1. Deploy virtual infrastructure using Terraform or Ansible scripts maintained within secure Git repositories.
2. Provision compute instances using hardened, ISM-compliant operating system images (e.g., Red Hat Enterprise Linux or Rocky Linux baseline builds).
3. Mount encrypted Ceph-backed block volumes or S3-compatible object buckets, applying bucket access policies and object lock capabilities for immutable archiving.

# Example Conceptual Terraform Snippet for Vault Cloud OpenStack VPC resource "openstack_networking_network_v2" "defence_secure_net" { name = "sds-protected-network" admin_state_up = true } resource "openstack_networking_subnet_v2" "defence_subnet" { name = "sds-protected-subnet" network_id = openstack_networking_network_v2.defence_secure_net.id cidr = "10.100.1.0/24" ip_version = 4 enable_dhcp = true }

Step 5: Continuous Monitoring and Incident Response Integration

1. Connect compute metrics and audit logs to Vault Cloud's 24/7 Australian-based Security Operations Centre (SOC).
2. Configure continuous compliance scanning tools to detect drift from standard ISM control configurations.
3. Establish clear incident escalation pathways directly linking your internal IT Security Officer (ITSO) with Vault Cloud’s security teams and the Australian Cyber Security Centre (ACSC).

Cost Considerations and Operational Trade-Offs

While Vault Cloud SDS provides robust sovereign security, technology leaders must evaluate financial and operational parameters when migrating workloads.

Financial Structure

• Predictable Pricing Model: Vault Cloud charges based on allocated compute (vCPU, RAM), storage capacity (GB/TB per month), and specific high-assurance security features (dedicated HSM partitions, direct cross-connects).
• Zero Egress Bandwidth Fees: Unlike mainstream global hyperscalers that charge substantial rates for bandwidth egress, Vault Cloud minimizes data transfer costs, significantly reducing overall operational expenditure for data-heavy intelligence and sensor workloads.
• Capital vs. Operational Expenditure: Utilizing SDS transforms custom datacenter building costs into an operational cost model (OpEx), enabling contractors to bill infrastructure directly against specific Defence contract milestones.

Operational Trade-Offs and Limitations

• Ecosystem Size: Foreign hyperscalers offer thousands of niche, proprietary SaaS microservices. Vault Cloud focuses on core IaaS, PaaS, OpenStack, and Kubernetes primitives. Complex specialized application stacks must be deployed and managed via containerized or virtualized software within the environment.
• Operational Discipline Required: Maintaining DISP and ISM compliance requires continuous internal governance. While Vault Cloud secures the underlying cloud platform ("Security OF the Cloud"), customer security teams remain responsible for configuring operating system patches, application vulnerabilities, and user access policies ("Security IN the Cloud").

Frequently Asked Questions

What makes Vault Cloud SDS different from global cloud providers with Australian data centers?

While global hyperscalers operate datacenters located physically in Australia, their corporate parents remain subject to foreign legal systems, such as the US CLOUD Act. This allows foreign courts to compel those parent entities to produce data managed by their subsidiaries globally. Vault Cloud is 100% Australian-owned and operated, ensuring its operational stack, staff, and corporate entity exist exclusively within Australian jurisdiction.

Is Vault Cloud SDS accredited for PROTECTED workloads?

Yes. Vault Cloud SDS has undergone rigorous IRAP assessments confirming that its underlying infrastructure, physical security, data center operations, and administrative processes comply fully with the controls mandated by the ASD Information Security Manual (ISM) for workloads classified up to PROTECTED.

How does Vault Cloud SDS help small defence contractors achieve DISP compliance?

Achieving DISP accreditation requires strict physical, personnel, and cyber security controls. By hosting digital assets on Vault Cloud SDS, defense contractors leverage an infrastructure platform that already meets ASD ISM and PSPF guidelines. This satisfies the baseline digital storage and infrastructure requirements needed for DISP approval without building local high-security server infrastructure.

Can SDS workloads be integrated with existing on-premises Defence networks?

Yes. Vault Cloud SDS supports direct high-speed network connections, including cross-connects to the Intra-Government Communications Network (ICON), Megaport, dedicated dark fibre links, and hardware-encrypted IPsec VPN tunnels. This enables secure hybrid deployment models where SDS extends existing secure on-premises server rooms.

How does Vault Cloud manage system administration and technical support?

All technical support, physical datacenter operations, hypervisor management, and security monitoring are performed exclusively by Australian citizens located in Australia. These personnel hold national security clearances ranging from Negative Vetting Level 1 (NV1) to Positive Vetting (PV), ensuring that no uncleared or foreign remote administrator ever accesses system infrastructure.

Strategic Next Actions for Security Officers and IT Architects

Organizations seeking to deploy or migrate defense workloads to Vault Cloud Sovereign Defence Security should take the following initial technical steps:

1. Review Data Classifications and DISP Requirements: Audit your contract security requirements to establish whether your workload requires PROTECTED level alignment or specific DISP Cyber Security membership levels.
2. Engage an Accredited IRAP Assessor: Engage an independent IRAP assessor early in your system design phase to review your planned system architecture on Vault Cloud against the latest ASD Information Security Manual controls.
3. Request Vault Cloud Security and Architecture Documentation: Contact Vault Cloud’s dedicated sovereign defence team to request their latest IRAP summary reports, system security plans (SSP), and technical OpenStack API documentation to inform your Terraform/Ansible infrastructure automation workflows.