Gatekeeper Public Key Infrastructure (PKI) Framework

The Australian Government reviewed the Gatekeeper Public Key Infrastructure (PKI) Framework to see if it is still an effective way to support secure digital authentication, signing and encryption.

Gatekeeper was created to build trust and consistency in online transactions. Since the Framework was last updated in 2015, government security policies and international PKI standards have changed.

The Review found that Gatekeeper is no longer the best way to achieve its original goals. Many of its requirements are now covered by:

• the Protective Security Policy Framework (PSPF)
• the Information Security Manual (ISM)
• international PKI standards and audit regimes.

Maintaining a separate accreditation scheme creates duplication, higher compliance costs and barriers for providers, without offering additional security or assurance benefits.

The following model preserves Gatekeeper’s original goals of trust, interoperability and assurance while shifting to modern, risk-based security and governance arrangements.

Recommendations

1. Retire the Gatekeeper Framework and strengthen PKI requirements within existing government security frameworks

The Gatekeeper accreditation framework will be retired on 6 April 2028. PKI requirements that aren’t already covered will be considered and incorporated into established whole-of-government security frameworks, including the ISM and PSPF. Entities may also draw on international PKI standards such as:

• WebTrust
• ETSI
• ISO/IEC 27001:2022
• ISO/IEC 27099:2022.

Why this is recommended

Bringing PKI assurance requirements into Australia's existing security frameworks will:

• reduce duplication
• strengthening compliance outcomes
• improve consistency
• help ensure PKI requirements keep pace with changing cyber threats, technologies and government policy.

2. Maintain support for PKI procurement decisions

The Department of Finance will work with the Digital Transformation Agency (DTA) to find alternative tools to support procurement decisions to replace the Gatekeeper Accredited Provider Register.

Why this is recommended

The Review recognises the value of the Gatekeeper Accredited Provider Register as a trusted source of information for government entities and relying parties when procuring PKI services.

The register provided a simple way to identify providers that had completed independent assessment and met recognised assurance requirements.

3. Strengthen PKI audit and assurance capability

The Department of Finance will engage with government, industry and the cyber security sector to help entities better understand and use international assurance reports and audit outcomes when making PKI procurement, assurance and risk-management decisions.

Why this is recommended

The Review found that many organisations rely on Gatekeeper accreditation as evidence of assurance instead of assessing assurance evidence and PKI risks directly. In some cases, this is due to limited access to specialist PKI expertise.

Improving awareness and understanding of international assurance frameworks and standards will help entities make informed procurement, assurance and compliance decisions.

Transition arrangements

The Gatekeeper Framework will be retired on 6 April 2028.

Until that date, existing Gatekeeper accreditations will remain valid and Finance will provide transition support to accredited providers and relying parties.

At the end of the transition period, providers:

• may continue to operate certificate authority services
• will no longer be able to claim Gatekeeper accreditation.

What this means for Australian Government entities

Australian Government entity’s will continue to be responsible for managing their PKI security and assurance. Including:

• assessing the risks associated with their PKI use
• selecting standards and assurance arrangements appropriate to the relevant use case
• evaluating provider and audit evidence
• meeting applicable ISM and PSPF requirements.

Accredited service providers

The Gatekeeper Competent Authority has granted accreditation to the following services: