Who owns the controls when your spatial service is managed by someone else?

When an environment includes a vendor-managed spatial service, control ownership must be defined before compliance can be demonstrated. When ownership is in question, accreditation can stall because accountability and evidence delivery haven’t been established.

What does the problem look like when it turns up?

It usually appears when an agency is accrediting an environment that includes a vendor-managed spatial service sitting outside its existing accreditation boundary.

By the time accreditation begins, the service is often already delivering value, with established users, support processes and operational responsibilities. Uncertainty tends to emerge when someone asks a seemingly straightforward question: who is responsible for demonstrating that a particular control is operating as intended?

This is a common pattern Onneer encounters when helping organisations apply the Essential Eight to ArcGIS environments. Spatial services often span agency systems, provider-managed components and supporting platforms and rarely fit neatly inside organisational boundaries. Those arrangements can work well operationally even while leaving unanswered questions about control ownership.

In many cases, everyone understands the service relationship. The agency knows what’s been purchased, and the provider understands what they are responsible for delivering. The difficulty appears when accreditation requires each control to be assigned, evidenced and accounted for.

Questions quickly emerge about whether a control is inherited, managed by the agency, managed by the provider or shared across multiple parties. If those questions haven’t already been answered, accountability becomes difficult to demonstrate, and evidence becomes difficult to collect.

Most of the accreditation challenges we see in these situations are not caused by missing controls; they arise because ownership was never explicitly defined to begin with.

Is a vendor's certification enough?

No. A vendor's broader security certifications may provide useful context, but they don't automatically demonstrate that controls are operating inside the specific service being accredited.

For Essential Eight Maturity Level 2, assessors need evidence that controls are operating within the environment being assessed. A provider may hold certifications elsewhere in its organisation, but that does not, by itself, demonstrate that controls are operating within the service under accreditation.

We occasionally see certifications treated as the end of the conversation when they are better understood as the beginning. The real question is how that assurance connects to the service being accredited.

This is rarely about trust. The challenge is usually more specific: who performs the control, how is it monitored, and what evidence demonstrates that it is operating effectively within the service?

What makes these conversations challenging is that the technology is often working exactly as intended. The real work lies in understanding how responsibilities, assurance and evidence connect to the service that's actually being accredited.

What must be settled before you start?

Before accreditation begins, there are three questions worth answering. Where does the accreditation boundary actually sit? For each control, who owns it, who operates it and who provides the evidence? And can privileged access be attributed to a named individual from end to end?

The accreditation boundary is the starting point because it determines what sits in scope and where assurance is required. When parties hold different views of that boundary, assessments often increase in complication.

Control ownership is equally important. In environments that include externally managed services, responsibility for ownership, operation and evidence can sit across multiple parties. If those responsibilities haven’t been clearly agreed and documented, gaps can remain unnoticed until the assessment is already underway.

Privileged access is often the third area that requires closer examination. Agencies need to understand how privileged access is approved, granted, monitored and reviewed across every part of the service. If activity cannot be traced back to an identifiable individual, demonstrating accountability becomes more difficult.

None of these questions require every responsibility to sit with the agency. They simply require responsibilities to be explicit. Once that visibility exists, inherited controls, provider-managed controls and agency-managed controls become much easier to understand, evidence and assess.

Where is this heading?

The Australian Signals Directorate’s move from the Essential Eight to the broader Essentials series, including the separation of cloud into its own chapter, reflects the growing importance of understanding control ownership in environments that span organisational and service boundaries. Shared responsibility models have become a normal part of technology delivery, and they require a clearer understanding of control ownership than older frameworks were designed to support.

For agencies accrediting spatial services, it reflects a challenge that is already appearing in accreditation discussions today.