If you manage services for organisations that touch veteran records, you are not running a normal managed service. You are holding the medical, service and welfare history of people who have already been asked to carry more than most. Get the architecture wrong and the consequence is not a support ticket. It is a person whose deployment history, injuries and treatment pathway sit in a stranger's hands, permanently, with no way to recall it.
This is the reference architecture we hold ourselves to. It is written for other MSPs, because the veteran ecosystem is served by a long tail of small providers, and the weakest link sets the standard for everyone.
## Start with the data, not the platform
Most MSP designs start with the platform and then work out what data will live in it. Reverse that order. Classify first.
Four tiers work well in this sector.
Tier one is identity and service data. Full name, service number, unit, dates of service, discharge category. On its own it looks harmless. Combined, it is a targeting package.
Tier two is health and welfare data. Diagnoses, mental health treatment, rehabilitation plans, claim documentation. In Australia this is sensitive information under the Privacy Act and it carries the highest duty of care in the stack.
Tier three is operational and case management data. Notes, correspondence, appointment records, support plans.
Tier four is everything else. Marketing, general enquiry, corporate systems.
Every architectural decision after this point references the tier, not the application. When a vendor asks to integrate, the first question is which tier they touch. If the answer is one or two, the bar moves and does not move back.
## Sovereignty is a data path question
Sovereignty is often reduced to a marketing line about a data centre in Sydney. That is the easy part. The hard part is the path the data actually travels and the jurisdiction of every party who can reach it.
Ask four questions of any platform in the design.
Where does the data rest. Where does it get processed, including transient processing for search, indexing, backup, machine learning and analytics. Who administers the underlying infrastructure and under what national law do they sit. Who can be compelled to hand it over, and can you be told when that happens.
A platform can store data in country and still be operated by staff offshore with standing administrative access. That is not sovereign. It is co-located. The distinction matters because the risk you are managing is not only technical compromise. It is lawful access under a foreign regime and support access from a jurisdiction you cannot audit.
This is why our tier one and tier two workloads run on Australian owned and Australian operated infrastructure with Macquarie Cloud Services, inside the Macquarie Technology Group estate. Australian sovereign data centres, Australian security operations, Australian staff, government grade facilities. When we say a workload is sovereign, we can name the building, the operator and the legal entity that answers for it.
## The reference topology
The design has five zones and one rule: data moves down a tier boundary only through a controlled interface, never through a shared credential or a flat network.
Zone one is the presentation layer. Public sites, portals, forms. It holds no tier one or tier two data at rest. It writes forward, it does not read back. A compromise here yields nothing of value.
Zone two is the application layer. Case management, workflow, integrations. It runs in a private subnet with no inbound internet exposure, reachable only through an application gateway with a web application firewall in front of it. All service to service traffic is mutually authenticated.
Zone three is the protected data layer. Databases, document stores, backups. Encrypted at rest with customer managed keys held in an Australian key management service. Encrypted in transit end to end, including inside the private network. No human standing access. Every read of tier two data is logged with a purpose code.
Zone four is the management plane. Jump hosts, privileged access workstations, monitoring, patch orchestration. Separate identity domain from production users. Administrative access is time bound, approved, session recorded, and expires automatically.
Zone five is the audit plane. Write once log storage in a separate account or tenancy with a different administrative boundary, so an attacker who owns production cannot rewrite the record of what they did.
Between zone two and zone three there is a schema level contract, not a general purpose connection. Applications do not run arbitrary queries against tier two data. They call defined operations that return only the fields the operation needs. It is more work up front. It is also the difference between a stolen application credential exposing one record set and exposing the entire client base.
## Identity is the control plane
In this architecture, identity does more work than the firewall.
Every human account uses phishing resistant multifactor authentication. Not SMS. Hardware keys or platform authenticators, enforced by policy, with no exemption list. Exemption lists are where breaches live.
Privileged roles are not held, they are requested. Just in time elevation, with an approver who is not the requester, a stated reason, a fixed window and an automatic revocation. The steady state number of standing administrators in a production environment holding tier two data should be zero.
Service identities are workload bound and short lived. No shared secrets in configuration files, no long lived keys in a password vault that a technician can copy to a laptop.
Client tenancies are isolated at the identity boundary as well as the network boundary. One compromised MSP technician account should not be able to traverse into every client you serve. The supply chain attacks against managed providers over the last few years all followed the same shape: one trusted administrative path into many customers. Break that path by design.
## Governance that survives contact
Controls that exist only in a policy document fail on the first busy Friday. Governance has to be enforced by the system.
Access reviews run quarterly and are evidence based. Not a manager signing a spreadsheet, but a report generated from the actual entitlement state, with orphaned and unused permissions automatically flagged and expired.
Change control covers infrastructure as code. Every environment is defined in a repository, peer reviewed, and deployed through a pipeline. Manual console changes are detected as drift and reverted. If you cannot rebuild the environment from the repository, you do not know what you are running.
Vendor assurance is continuous. Every subprocessor that touches tier one or tier two data is registered with the jurisdiction of processing, the access model, the breach notification commitment and the exit path. If a vendor cannot answer where their support staff sit, they do not get the tier.
Incident response is rehearsed against the scenario that matters. Not a generic ransomware tabletop, but the specific scenario of confirmed exfiltration of veteran health records. Who calls the client. Who calls the regulator, within what window. Who briefs affected individuals, and in what language. Rehearse the notification, not just the containment. The notification is the part organisations always do badly.
Retention is enforced, not aspirational. Data that has passed its retention period is deleted on a schedule, including from backups, with a certificate of destruction. The safest record is the one you no longer hold.
## Monitoring the things that actually indicate harm
Volume based alerting produces noise and trains people to ignore it. Alert on intent.
Bulk read of tier two records outside an approved batch process. Access to a record set with no corresponding case activity. Administrative elevation outside change windows. New service principal creation. Export or report generation above a defined threshold. Access from a network path or country never before seen for that account.
Each of these maps to something a person did. That is what makes them useful. A twenty four hour Australian based security operations capability watching those signals is worth more than a wall of dashboards nobody reads at three in the morning.
## What this means for the practice
Building to this standard changes an MSP business, not only its engineering.
It changes the conversation with clients. Instead of a capability statement, you can walk a board through the topology, name the operator of the infrastructure, show the audit plane and describe the notification rehearsal. Defensible beats impressive.
It changes what you can bid for. Defence adjacent, health and government adjacent work carries assurance requirements that most general MSPs cannot meet without a rebuild. If the architecture is already there, the assurance work is documentation rather than remediation.
It changes your risk. The most expensive event in this sector is not an outage. It is a breach of records belonging to people who served, followed by the discovery that the design never really accounted for it.
## The standard
I came to technology through a trade and through service. Twelve years in the Royal Australian Air Force, time on the road as a Queensland Ambulance paramedic, a mechanical fitter ticket, and years running industrial rope access work where a control either holds or a person falls. That background sets the standard I bring to architecture. You do not certify a system because the paperwork is tidy. You certify it because you have tested the load path and you would stand under it yourself.
Veteran data deserves that same discipline. These are people who accepted risk on behalf of the country. Holding their records to a lower standard than we hold a harness inspection is not a technical failure. It is a failure of respect.
Build it properly. Name your operator. Prove your path. Rehearse the bad day before it arrives.
Shaune Irving is Chief Technology Officer at Keytech Intelligence, an Australian sovereign technology and managed services provider working across the veteran, defence and enterprise sectors.
