IRAP Assessment Guide (2026): Australia's Infosec Registered Assessors Program

Who needs an IRAP assessment

• Australian Government entities use IRAP assessments to support system authorization under the PSPF and ISM (ASD IRAP).
• Cloud service providers (CSPs) and SaaS vendors selling to federal, state or local government commission assessments so agencies can rely on them in their own risk assessments. Microsoft describes IRAP as applying to Australian government agencies that use cloud services, and notes that New Zealand agencies can also use IRAP assessments (Microsoft).
• Gateway, GovLINK and classified-system operators need assessment for systems handling information classified SECRET and below (ASD IRAP).

What gets assessed: the ISM

The ISM is ASD's cybersecurity framework for protecting IT and operational technology systems. It's written for CISOs, CIOs, security professionals, and IT and OT managers (ASD ISM). ASD publishes regular releases, archives older ones, and provides OSCAL (machine-readable) versions. The ISM complements the PSPF, which is published by the Attorney-General's Department (AWS).

Microsoft describes the ISM's risk-management framework as drawing on NIST SP 800-37 Rev. 2, in six steps (Microsoft):

1. Define the system.
2. Select security controls.
3. Implement security controls.
4. Assess security controls.
5. Authorize the system.
6. Monitor the system.

An IRAP assessment covers step 4. The system owner's authorizing officer then carries out step 5.

How an IRAP assessment works

1. Select an assessor from ASD's IRAP assessors list. Assessors are ASD-endorsed ICT professionals with experience in security assessment and risk management and "a detailed knowledge of ASD's Information Security Manual" (ASD IRAP).
2. Agree the scope. This covers the system boundary, classification level (for example OFFICIAL: Sensitive or PROTECTED), applicable ISM controls and the ISM release.
3. Fieldwork. Microsoft describes assessors examining IT operations, physical data centers, intrusion detection, cryptography, network security, access control and risk management (Microsoft).
4. Reporting. The assessor writes an assessment report or letter of completion recording what was tested, how effective the controls are, and the residual risks.
5. Authorization. The consuming entity reviews the report and decides whether to authorize the system. ASD stresses that consumers must read reports "to determine what a system has been tested against, and if it meets your needs" (ASD IRAP).

For cloud providers, AWS's IRAP PROTECTED pack shows what a typical package contains (AWS):

• an assessment letter
• a cloud assessment report
• a cloud security controls matrix
• a reference architecture
• a consumer guide

The controls matrix shows which controls the provider is responsible for and which the customer must implement.

From certification to assessment: the 2020 change

On 2 March 2020, ASD and the Digital Transformation Agency closed the Cloud Services Certification Program. ASD stopped being a certification authority, all certification letters became void from 27 July 2020, and the ISM dropped the requirement to pick services from the Certified Cloud Services List. Commonwealth entities are now "responsible for their own assurance and risk management activities" and can self-assess cloud services (AWS). Claims that a product is "IRAP certified" are therefore inaccurate. The correct wording is "IRAP assessed", at a stated level and against a stated ISM release.

Timeline and costs

ASD doesn't publish a fixed timeline or fee schedule. Assessors charge commercial rates, and the length of an assessment depends on scope, classification and how ready your evidence is. Because the ISM is updated regularly, assessments are tied to a particular release. Providers maintain currency through new assessments and incremental ones. For example, Microsoft completed incremental assessments in December 2020 to add services (Microsoft).

Penalties

IRAP has no statutory penalties. The consequences are commercial: without a current assessment report, agencies may not be able to authorize your service.

Mapping to related frameworks

• Essential Eight: the ISM contains the Essential Eight mitigations, and assessments usually report on Essential Eight maturity.
• ISO/IEC 27001 and SOC 2: CSPs offer these alongside IRAP packs. AWS, for example, lists SOC 1/SOC 2 Type II reports and its ISO 27001 certificate (AWS). Assessors may draw on this evidence, but it doesn't replace ISM testing.
• NIST SP 800-37 / FedRAMP: the risk-management lifecycle is similar, and FedRAMP is the closest US equivalent.
• PSPF: the policy layer that the ISM puts into practice.

Readiness checklist

1. Confirm the target classification and which customer requirements drive the assessment.
2. Download the current ISM release and filter the controls by applicability.
3. Define the system boundary, data flows and shared-responsibility model.
4. Write a System Security Plan and statement of applicability with a justification for each control.
5. Implement and evidence the Essential Eight controls first.
6. Gather evidence: configurations, logs, policies, penetration test results and incident-response tests.
7. Engage an assessor from ASD's list and agree the scope in writing.
8. Remediate findings and record residual risks with their treatments.
9. Prepare a consumer guide and responsibility matrix for agency customers.
10. Plan reassessment for when the ISM or your service changes significantly.

Common pitfalls

• Marketing a product as "IRAP certified" or "accredited".
• Scoping too narrowly, so agencies find their workloads aren't covered.
• Assessing against an outdated ISM release.
• Leaving out customer-side controls from consumer guidance.
• Assuming an assessment means full ISM compliance. ASD says it doesn't.

How AssureCore helps

AssureCore's Controls Register and Evidence Management (with expiry alerts and control linking) can track ISM control evidence. The Risk Register holds residual risks with action plans, and Audit Reports export to PDF and CSV for assessors. Cross-framework Mapping reuses ISO 27001 and SOC 2 evidence.

Frequently asked questions

Official references

• ASD – Infosec Registered Assessors Program (IRAP)
• ASD – Information Security Manual
• AWS – IRAP compliance
• Microsoft – IRAP compliance offering

Related frameworks

• ISO 27001 guide
• SOC 2 guide
• NIST CSF guide
• NIST 800-171 guide