Skip to content
Public sector

GovCMS alternative

A modern, vendor-independent option for Australian government and public-sector teams looking beyond GovCMS Drupal. Magnolia CMS deployed inside IRAP and ISM boundaries, with familiar authoring, WCAG 2.1 AA from the floor up, and a clean migration path.

Where GovCMS hits its limits

GovCMS is a sensible choice for many agencies. For others, the constraints add up. Here are the three patterns we hear most often in 2026.

Vendor concentration risk

GovCMS is Drupal plus Acquia Cloud Site Factory. A platform decision is implicitly a long-term commitment to both. Some agencies want explicit vendor independence in their stack.

Customisation ceiling

Deep customisation outside the GovCMS distribution can run into panel pricing, contribution-back requirements and module-compatibility constraints. Bespoke integrations get expensive.

Multi-site TCO

Per-site SaaS pricing scales linearly. Agencies running multiple portfolios or sites often find a self-hosted Magnolia deployment cheaper across a five-year horizon.

What Magnolia delivers for public-sector teams

A modern, hybrid CMS deployable inside an agency security boundary, with familiar authoring and a clean migration path off GovCMS Drupal.

Australian-hosted deployment

Magnolia Cloud in the Australian region, or self-hosted on customer-owned AWS Sydney (ap-southeast-2) or Azure Australia East. Data residency, backups and DR within Australia.

IRAP and ISM aligned

Deployment patterns aligned to the ASD Information Security Manual. For PROTECTED workloads we extend the agency IRAP assessment or scope Magnolia into a new one.

WCAG 2.1 AA floor

Accessibility is the design starting point, not a polish step. Automated checks in CI, manual screen-reader and keyboard testing before release. WCAG 2.2 AA default for 2026 builds.

GovCMS migration path

Migration Accelerator captures content from GovCMS Drupal and writes pages into Magnolia under human approval. Migration scheduled around content freeze windows and election sensitivity.

Authoring familiarity

WYSIWYG editor, content modelling, multi-language, scheduling and workflow. GovCMS authors are typically productive on Magnolia within their first day.

Vendor independence

Magnolia DX Core ships as a JAR. Customer keeps deployment, hosting and contractual freedom. No lock-in to a single hosting partner.

How we deliver for public sector

A five-stage approach designed around agency security accreditation, content freeze windows and editorial governance. Most single-site migrations go live in ten to eighteen weeks.

1

Discovery and security pathway

Two to four weeks. GovCMS audit, content inventory, integration map, security classification (OFFICIAL, OFFICIAL:Sensitive, PROTECTED) and a deployment pattern aligned to ISM controls. Architecture pack for the agency security advisor.

2

Information architecture and templates

Content types, template library and authoring patterns. We re-implement design-system components (including CivicTheme where the agency wants Single Digital Presence parity) as Magnolia components.

3

Build and integrate

Iterative sprints. Frontend, backend, integrations (SSO, search, payments, agency-specific systems), DevOps. Fortnightly demos against a live environment your team can use.

4

Content migration and editorial training

Migration Accelerator handles GovCMS-to-Magnolia content move. Editorial training runs in parallel. Two of our team embed in the editorial room during the first content-load sprint.

5

Accreditation, launch and managed run

Final IRAP or agency security plan walkthrough. WCAG audit, penetration test, accessibility statement. Cutover with rollback plan. Managed support thereafter under the agency hours of cover.

GovCMS alternative: FAQ

The questions Commonwealth and state agency teams ask us most often about leaving GovCMS.

GovCMS is the Australian Government managed Drupal platform delivered through Salsa Digital and a panel of partners, hosted on Acquia Cloud Site Factory. It works well for departments that fit the standard Drupal pattern and want a turnkey ATO-aligned platform. It struggles when agencies need deep customisation outside the GovCMS distribution, when they want vendor independence from Drupal and Acquia, when bespoke integrations exceed the panel pricing model, or when they need a modern composable architecture rather than a monolithic CMS.

Magnolia Cloud and Magnolia DX Core can be deployed in IRAP-assessed configurations on Australian-hosted infrastructure (AWS Sydney, Azure Australia East). Magnolia itself does not have a single all-encompassing whole-of-government certification, but it can be deployed inside an agency boundary that does. We design the deployment to satisfy the agency security plan and the ASD Information Security Manual (ISM) controls that apply.

For PROTECTED workloads, we deploy Magnolia on customer-owned AWS or Azure infrastructure inside the agency security boundary, applying the relevant ISM controls (boundary security, identity, logging, vulnerability management). Where the agency holds an existing IRAP assessment we extend it; where they do not, we work with their IRAP assessor to scope Magnolia into the new assessment. For OFFICIAL and OFFICIAL:Sensitive workloads, Magnolia Cloud in the Australian region is usually sufficient.

Noice charges against our 2026 rate card (AUD 165 to AUD 275 per hour or AUD 1,320 to AUD 2,200 per day, ex GST). GovCMS SaaS pricing sits at AUD 35k to AUD 100k per year per site at the most common tiers, before customisation. A typical Magnolia deployment for a single agency site costs AUD 180k to AUD 450k for first build plus AUD 60k to AUD 140k per year for Magnolia licence and managed hosting. The math turns Magnolia-favourable for agencies with two or more sites, heavy customisation, or material editorial automation needs. We model the five-year TCO during discovery.

Yes. We have migrated agencies off GovCMS Drupal onto Magnolia using Migration Accelerator. The tool captures content from GovCMS, infers the content shape, and writes pages into the target under human approval. The migration plan respects content freeze and Federal Election sensitivity windows so editorial pace is not disrupted.

Yes. WCAG 2.1 AA is the floor for every public-facing build we deliver. We design from accessible patterns up, run automated checks in CI, and run manual screen-reader and keyboard testing before release. WCAG 2.2 AA is our default for new builds in 2026. The lift to AAA is scoped where the agency policy requires it.

CivicTheme is a Drupal-first design system. We can re-implement CivicTheme components as Magnolia components for visual consistency with adjacent agency sites. Where the agency wants full SDP alignment we deliver Magnolia under SDP design guidelines, integrate with whole-of-government navigation patterns, and use the SDP accessibility tone of voice.

Yes. Magnolia authoring is familiar to GovCMS Drupal authors: WYSIWYG editing, content modelling, multi-language, scheduling and workflow are all native. Authors are typically productive on the new platform within their first day of training. We embed two of our team in the editorial room during the first content-load sprint.

A single-site agency migration runs ten to eighteen weeks end to end. Multi-site, multi-portfolio migrations run six to nine months. Most of the timeline is content modelling, accessibility testing and security accreditation, not technical extraction.

We are pursuing a place on the GovCMS Digital Experience Platform tools and services panel (AusTender SON3816897) as a Magnolia partner. While that work proceeds we partner with existing panel members where the procurement pathway requires it. We can also deliver outside the panel via Digital Marketplace, individual agency procurement or the relevant DTA arrangements.

Ready to scope a GovCMS alternative?

A one-hour scoping call gets you a sized roadmap, a deployment pattern aligned to your security classification, and a five-year TCO model versus GovCMS SaaS.