An IRAP assessment is an independent security assessment of a system against the Australian Government’s Information Security Manual, carried out by an endorsed IRAP assessor. It is typically needed by organisations that handle government data or want to sell services to government. It measures how well a system meets the controls required to protect government information.
What IRAP is
IRAP stands for the Infosec Registered Assessors Program. It is administered by the Australian Signals Directorate and provides a pool of endorsed assessors who are qualified to assess systems against the Australian Government’s security requirements. An IRAP assessment is the process by which one of those endorsed assessors independently reviews a system and documents how well it meets those requirements.
The key word is independent. An IRAP assessment is not a self-assessment or a vendor claim. It is a structured, external review carried out by someone recognised as competent to do it, which is what gives the results credibility with government buyers.
What an IRAP assessment involves
At its heart, an IRAP assessment measures a system against the Information Security Manual, the ASD’s catalogue of security controls. The assessor examines the system’s design and operation, evaluates how effectively it implements the relevant controls, identifies gaps, and documents the findings.
The output is a clear picture of the system’s security posture: which controls are met, which are not, and what the residual risks are. That documentation is what a government decision-maker uses to decide whether the system is suitable to handle their information, and under what conditions.
Who needs one
An IRAP assessment is typically needed by organisations in a few situations. The most common is wanting to provide a product or service to government, where the buyer requires assurance that the system meets the ISM. Another is handling government data directly, where the sensitivity of the information calls for independent assessment. Cloud and technology providers seeking to serve the public sector frequently pursue IRAP assessment for exactly this reason.
If your organisation is not touching government data and has no ambitions to sell to government, IRAP is generally not something you need. It is a specific tool for a specific context, rather than a general security certification for every business.
The role of the ISM and the controls it sets
The Information Security Manual is the foundation of an IRAP assessment. It sets out the controls the Australian Government expects to see protecting its information, organised by risk. An IRAP assessment is, in essence, a structured measurement of a system against the relevant subset of those controls.
Because the ISM is maintained and updated by the ASD, it reflects current government expectations rather than a fixed historical checklist. Understanding which parts of the ISM apply to your system, based on the sensitivity of the data and how the system is used, is a large part of scoping an assessment sensibly.
IRAP versus certification
A common misunderstanding is to treat IRAP as a pass or fail certificate, like a badge you either earn or do not. It is more accurate to think of it as an assessment of security posture. An IRAP assessment documents how well a system meets the ISM and what the residual risks are. It does not, by itself, authorise a system to operate.
The decision to accept a system and its residual risks rests with the relevant government authority, informed by the IRAP assessment. In other words, IRAP provides the independent evidence, and the government makes the risk-based decision. That distinction matters when planning, because the goal is not simply to obtain a document but to demonstrate a security posture a government buyer can accept.
How to prepare for an IRAP assessment
Preparation is what makes an assessment efficient and successful. The practical steps are to understand which ISM controls apply to your system, honestly assess your current state against them, close the gaps that matter, and gather the evidence that shows each relevant control is genuinely in place. Going into an assessment with unaddressed gaps and no evidence turns it into an expensive gap analysis.
Experienced help is often valuable here, both to interpret which controls apply and to prepare the environment and evidence before the assessor arrives. Our security risk assessments can establish where you stand against the relevant controls, and our virtual CISO services can guide the remediation and preparation that make an assessment go smoothly.
For the program and the manual, see the cyber.gov.au IRAP and Information Security Manual pages.
Frequently asked questions
What is an IRAP assessment?
An IRAP assessment is an independent review of a system against the Australian Government’s Information Security Manual, carried out by an assessor endorsed under the Infosec Registered Assessors Program. It documents how well the system meets the required controls and what the residual risks are.
Who needs an IRAP assessment?
Organisations that want to provide products or services to government, or that handle government data directly, typically need one. Cloud and technology providers serving the public sector often pursue IRAP assessment. Organisations with no government data or ambitions generally do not need it.
Is IRAP a certification?
Not exactly. IRAP assesses and documents a system’s security posture against the ISM rather than issuing a simple pass or fail certificate. The decision to accept a system and its residual risks rests with the relevant government authority, informed by the IRAP assessment.
How do you prepare for IRAP?
Understand which ISM controls apply to your system, assess your current state against them, close the gaps that matter, and gather evidence that each relevant control is in place. Preparing properly turns the assessment into a confirmation of your posture rather than an expensive gap analysis.
