IRAP (Infosec Registered Assessors Program) is run by the Australian Signals Directorate, and a government contract has just made it the thing standing between you and a signed deal. This page explains what the programme asks, what an assessment produces and where readiness work usually gets stuck.
IRAP applies where a system will store, process or communicate Australian Government information at a security classification. The test is the data and the classification, not the size of the supplier: a two-person company handling PROTECTED data is in scope and a large enterprise handling none is not.
A growing number of government buyers and prime contractors require an IRAP assessment as a condition of contract even where the classification level would not strictly demand one. In practice the requirement arrives in a tender document rather than a regulation.
If you handle no Australian Government information at classification and no buyer has asked, IRAP is not your framework, and pursuing it speculatively is one of the more expensive mistakes available in this market. ISO 27001 is usually the right answer for commercial assurance.
Summarised from the ASD Infosec Registered Assessors Program and the Information Security Manual. The official source governs.
IRAP /
ASD
IRAP is administered by the Australian Signals Directorate. It provides a pool of ASD-endorsed assessors who evaluate a system’s security against the Information Security Manual and document the findings for the entity that must make an authorisation decision.
An IRAP assessment is not a certification and it does not authorise anything. It produces a report. The decision to authorise a system to handle government information at a classification is made by the accountable authority in the government entity, not by the assessor and not by the supplier.Read the official programme page
Unlike a maturity model, IRAP has no levels. What determines the size of the work is the system boundary and the classification of the data, and both are decisions made before the assessment starts.
Which systems, networks, data flows and physical locations are in.
Determines scopeThe classification of the data the system handles.
Determines the control setShared and inherited controls from underlying platforms.
Determines what is re-evidencedThird-party and supply-chain dependencies.
Determines who else is in viewThe catalogue an IRAP assessment tests against.
Documented for the authorising entity, not issued as a certificate.
The controls that apply are determined by the classification level of the data the system handles. A system handling OFFICIAL data and one handling PROTECTED data face materially different control sets from the same catalogue, and the boundary you draw determines which systems are inside that judgement at all.
The ISM is a catalogue of hundreds of controls, and the practical requirement is evidence that each applicable one is implemented and operating. That is a documentation and evidence discipline more than a technology programme: most organisations find the technical controls are largely present and the evidence that they operate is not.
The scoping decision is where IRAP engagements are won or lost. A boundary drawn generously (“the whole platform”) pulls in systems that never needed to be there, multiplies the control count and adds months. A boundary drawn too tightly gets rejected by the authorising entity and the work is redone.
The decision that sets the costThe right boundary is the smallest one that genuinely contains the government data, and establishing it takes a workshop rather than an assumption.
IRAP is the assessment programme; the ISM is the control catalogue it assesses against. Other frameworks overlap with it, but none substitutes for it.
| Framework | Relationship | What it does get you | What it doesn’t |
|---|---|---|---|
| Essential Eight | Prerequisite | Maturity Level 3 is a practical prerequisite. Organisations with mature patching, access control and application hardening move through the technical portion of an IRAP assessment substantially faster. | Essential Eight Maturity Level 2 does not make you IRAP-ready. Eight mitigation strategies against hundreds of ISM controls is not a matter of degree. |
| Information Security Manual | Assessed against | IRAP is the assessment programme; the ISM is the control catalogue it assesses against. They are not alternatives. | Holding an ISM-aligned position is not the same as having been assessed. The assessment is the artefact the authorising entity needs. |
| ISO 27001 | Overlapping | Much of the control set overlaps. Organisations serving both government and commercial customers often pursue both, with programmes structured to reduce duplication across the two. | They serve different purposes. IRAP prescribes specific ISM controls and is mandatory for government-related systems; ISO 27001 allows risk-based control selection and is internationally recognised for commercial purposes. Neither substitutes for the other. |
| SOC 2 | Unrelated | Evidence collected for SOC 2 is partially reusable, particularly around access control and change management. | A SOC 2 report carries no weight in an Australian Government authorisation decision. It answers a different market’s question. |
The control overlap is substantial enough that a single evidence programme serves both, and organisations that do them sequentially usually rebuild about half the evidence set the second time. If you must choose one first, choose the one your blocked deal requires.
These cost months rather than weeks, and every one of them is a scoping or evidence problem rather than a technology problem.
“The whole platform” is the most expensive sentence in an IRAP programme. It pulls in systems that never handle government data, multiplies the applicable control count, and adds months of evidence work that the authorising entity never needed.
Assessors issue evidence requests covering policies, procedures, configuration standards and operational records. Organisations that begin collecting at that point add weeks, because the evidence often does not exist in the form required and has to be generated.
Teams arrive believing Maturity Level 2 puts them most of the way there. It covers eight mitigation strategies; the ISM catalogue covers governance, personnel, physical, cryptographic and system-specific domains it does not touch.
Systems built on a cloud platform inherit a substantial number of controls from that platform. Where the inheritance is not documented, the assessor treats them as unevidenced and the organisation re-evidences work the platform already did.
The assessment produces a report. The authorisation is made by the accountable authority in the government entity, on their timetable. Organisations that plan to a date that ends at the assessment find there are weeks or months still to run.
We establish the system boundary, run a gap analysis against the applicable ISM controls, and build the evidence set an assessment expects to find, so that when an assessor is engaged, the work is confirmation rather than discovery.
Everything below is yours to keep, in the format stated, handed to the named recipient.
The boundary, documented and justified, with in-scope systems, data flows and inherited controls named.
Document · architecture and riskEvery applicable control, its current state, the gap, and what closes it, prioritised and effort-estimated.
Register · security and ITPolicies, procedures, configuration standards and operational records, organised the way an assessor requests them.
Evidence repository · audit-readyWhat the underlying platform provides, evidenced, so it is not re-evidenced unnecessarily.
Mapping document · architectureOrganised by ISM domain and by what determines scope. On this framework the boundary is the biggest cost driver in the engagement.
The boundary is agreed first. It is the biggest cost driver in the engagement, so it is documented and agreed in the scoping workshop before the gap analysis begins.
Boundary and classification
Gap analysis
Evidence
Inheritance
Assessor preparation
The IRAP assessment itself: Performed by an independent IRAP assessor you engage. For IRAP-related work, we clearly separate assessment and advisory roles.
The authorisation decision: Made by the accountable authority in the government entity. Not the assessor’s, and certainly not ours.
Remediation: We identify gaps and sequence them. Closing them is your team or separate scoped work.
Assessor fees: Where an independent assessor is engaged, their fees are separate and billed by them.
Ongoing monitoring: A point-in-time readiness position.
Each included area covers the three items listed above. Anything outside this boundary is identified in the scoping workshop and separately scoped only when it is genuinely required.
Quality principle: The distinction that matters here is between a control that is implemented and a control that can be evidenced as implemented. Most organisations approaching IRAP have more of the first than they think and less of the second. Our gap position reports them separately, because the remediation for each is entirely different: one needs engineering and the other needs a record.
Our part and the parts that belong to someone else are shown together, because a supplier with a blocked deal commits to a customer on the full figure.
Two workshops (half a day each) with architecture, security and the commercial owner of the government contract.
Weeks 1 to 2Access to system documentation and data flow records.
Weeks 3 to 4A technical point of contact for roughly 6 hours a week, plus 6 to 10 interviews.
Weeks 5 to 9Platform report retrieval and roughly 4 hours a week.
Weeks 10 to 13One walkthrough session, half a day.
Weeks 14 to 16Remediation of material gaps. External, not us. Duration depends entirely on what the gap analysis finds. Typically 2 to 6 months.
Independent IRAP assessment. External, not us. Scheduled by the assessor, typically 4 to 8 weeks.
Authorisation decision. External, not us. Made by the government entity’s accountable authority, on their timetable, typically 4 to 12 weeks.
The whole path is usually 9 to 18 months. Our readiness work runs 12 to 16 weeks. Remediation, the assessment itself and the authorisation decision all sit outside our control. We publish the whole path rather than only our part, because showing only our sixteen weeks would be an over-claim by omission.
What your scope actually looks like, what it would cost, and whether this is the right framework for you at all. With Steve Sharma, who would lead the engagement.
Founder & Principal
Runs the scoping workshop and the gap analysis personally. The boundary decision is not delegated, because it determines the cost of everything after it.
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Full profileSteve Sharma is an ASD-endorsed IRAP Assessor. This engagement is readiness advisory; it is not an IRAP assessment, and the assessment itself is performed by an independent IRAP assessor you engage. We can support both assessment and remediation across different engagements, but we maintain independence where the same system is being assessed. For IRAP-related work, we clearly separate assessment and advisory roles.
We do not make, influence or participate in the authorisation decision. That is made by the accountable authority in the government entity.
What you receive from this engagement is a readiness position and an evidence set, not an assessment report and not an authorisation.
Remediation is not part of this engagement, and we never assess remediation we performed.
We do not run your SOC or monitor your environment.
IRAP readiness scope
Register to see indicative feesA starting fee, shown to registered users. The boundary is confirmed in the scoping workshop and the fee is confirmed in writing at the end of it; we would rather re-quote than absorb a boundary that grew.
System boundaryIncreases the fee. The primary driver by a wide margin: the fee grows faster than the boundary does.
Classification levelIncreases the fee. A higher classification pulls in materially more of the ISM catalogue.
Evidence readinessIncreases the fee. Evidence that must be generated, rather than collected, takes more work to produce.
Essential Eight maturityReduces the fee. Where Maturity Level 3 is already evidenced, the technical control portion moves considerably faster.
No IRAP-specific self-assessment exists, and building one would be misleading given the scoping complexity: the answer depends on a boundary nobody has drawn yet. The honest substitute is an Essential Eight position, since Maturity Level 3 is a practical prerequisite and the evidence is reusable.
The authority and a direct route to each official source stay visible here.
This page summarises published guidance for practical use. Where it differs from the source, the source governs. The Australian Signals Directorate updates the ISM and the IRAP programme documentation periodically, and we revisit this page when it does. The programme’s own rules about assessor roles are exactly what a reader should check independently, which is why they are linked rather than summarised.
Written by Steve Sharma, Founder & Principal. At our scale the author and reviewer are one person, and saying so is more honest than inventing a second name.
Founder & Principal
Reviewed for practical accuracy against the IRAP programme documentation and the Information Security Manual.
What it is, who it binds, and what the assessment actually produces.
The whole path, including the parts that are not ours.
Where the control sets overlap, and what the remainder demands.
The short answer is no. This is the long one.
No. The Essential Eight covers eight mitigation strategies; an IRAP assessment tests the far broader ISM control catalogue, including governance, personnel, physical and cryptographic domains it does not touch. Maturity Level 3 is a practical prerequisite, not a substitute.
Our readiness work runs 12 to 16 weeks. The full path is usually 9 to 18 months: remediation, the independent assessment and the authorisation decision all sit outside our control and outside our timetable. Anyone quoting you a date that ends at the assessment is describing a third of the path.
Not on a system we have prepared. Steve Sharma is an ASD-endorsed IRAP Assessor. We can support both assessment and remediation across different engagements, but we maintain independence where the same system is being assessed. For IRAP-related work, we clearly separate assessment and advisory roles.
Only if a system will handle Australian Government information at a classification, or a buyer has made it a condition. If neither is true, pursuing IRAP speculatively is one of the more expensive mistakes available in this market. ISO 27001 is usually the right answer for commercial assurance, and we would say so in the scoping call.
The system boundary, by a wide margin. The fee grows faster than the boundary, because the control count and the evidence volume both compound. That is why the fee is confirmed at the end of the scoping workshop rather than before it.
Some of them, as separate scoped work. We never assess remediation we performed, and for a great deal of the technical uplift your own team or a cheaper provider is the better answer. We will say which.
Official sources govern. This page explains their practical application.