IRAP: Australian Government Security Assessment Guide
The Information Security Registered Assessors Program (IRAP) is the Australian Signals Directorate's framework for independently assessing ICT systems against Australian government security requirements. IRAP assessors evaluate whether systems meet the controls specified in the Australian Government Information Security Manual (ISM).
What IRAP Covers
IRAP assessments evaluate systems against the ISM, which contains hundreds of controls organized across governance, physical, personnel, and ICT security domains. The assessment determines whether a system is suitable for handling Australian government data at a specific classification level: OFFICIAL, OFFICIAL: Sensitive, PROTECTED, or above.
Key assessment areas include security governance and risk management, personnel security, physical security, communications security, ICT security (operating systems, databases, applications, networks), and gateway security for systems connecting to government networks.
Who Needs IRAP
IRAP assessment is required for any ICT system that processes, stores, or communicates Australian government data. This primarily affects cloud service providers, managed service providers, and technology companies seeking to serve Australian government agencies.
Major cloud providers (AWS, Azure, Google Cloud) have obtained IRAP assessments for their Australian regions. SaaS companies selling to Australian government agencies are increasingly expected to demonstrate IRAP assessment at the appropriate classification level.
The IRAP Assessment Process
- Scope definition — Determine the system boundary and target classification level
- Engage an IRAP assessor — Select an ASD-endorsed assessor from the published register
- Stage 1 assessment — Review of security documentation, policies, and architecture
- Remediation — Address gaps identified in Stage 1
- Stage 2 assessment — Technical testing and validation of control implementation
- Assessment report — Assessor produces a Security Assessment Report (SAR)
- ASD review — For cloud services, ASD reviews the report and may list the service on the Certified Cloud Services List (CCSL)
Cost Factors
Assessment costs depend heavily on the target classification level and system complexity. OFFICIAL-level assessments for straightforward systems may cost $50,000 to $100,000, while PROTECTED-level assessments for complex cloud platforms can exceed $300,000. The largest cost components are assessor fees, remediation of identified gaps, and the documentation effort required to produce compliant security documentation.
Relationship to Essential Eight
The Essential Eight maturity model is a subset of ISM controls that IRAP assessments frequently reference. Organizations targeting IRAP assessment should aim for Essential Eight Maturity Level 2 or 3 as a foundation before engaging an assessor.