Scope definition
Define the system boundary, data flows and classification before assessment begins.
Australia · Australian Signals Directorate (ASD) · IRAP
Information Security Registered Assessors Program
The ASD-endorsed program that certifies cybersecurity professionals to assess ICT systems against the ISM.
What it is
IRAP is the ASD program that trains and authorises professionals to independently assess ICT systems against the ISM. Systems that process Australian Government information at OFFICIAL: Sensitive or higher need an assessment. Cloud providers and SaaS vendors hosting Commonwealth workloads commonly use it. An IRAP assessment produces a Security Assessment Report. The Authorising Officer then accepts residual risk through an Authority to Operate.
Who it applies to
Cloud services and systems proposed for Commonwealth use at OFFICIAL: Sensitive or PROTECTED. State and territory governments, critical infrastructure operators and defence suppliers often adopt it too.
Requirements
Stage 1 assessment
Check at design stage whether proposed controls adequately protect the classified data.
Stage 2 assessment
Review controls once implemented - checking evidence, testing and residual risk.
Security assessment report
Formal report for the system owner and Authorising Officer, aligned to ISM controls.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.