Advisory

IRAP Assessment

ASD-endorsed IRAP assessments for IT systems, cloud services, gateways and systems that serve government, at SECRET and below.

An independent check. Clearer risk decisions.

IRAP assessors are ICT security experts endorsed by the Australian Signals Directorate (ASD). They check a system against the Information Security Manual (ISM) and other relevant Australian Government frameworks, and they report what they find. Vectra helps you set the scope, prepare your evidence, fix weak spots and complete an objective assessment. The result shows how your controls are built and how well they work, so system owners and authorising officers can make risk-based decisions.

IRAP Assessment

Based on evidence. Aligned to what government requires.

June 2026
The current ISM release
April 2025
IRAP Common Assessment Framework
SECRET
and below: the classifications we can assess
Independent
An objective assessment of the controls in place

Support before, during and after the formal assessment.

Readiness

IRAP readiness assessment

Before the formal work starts, we review the system, the evidence you have and where your controls are likely to fall short.

Scoping

Assessment boundary

Define the services, environments, data flows and dependencies in scope, plus inherited controls and who is responsible for what.

Documentation

Security document review

Review the System Security Plan, the design, risk records, how each control is described, procedures and other evidence.

Assessment

Formal IRAP assessment

Assess the controls in place against the latest relevant ISM release and other Australian Government policy and guidance.

Cloud

Cloud service assessment

Assess cloud providers and their services, who is responsible for what, where data is held, and how cloud controls are built.

Technical

Security testing

Use interviews, examination and technical tests to support our findings on how controls are built and how well they work.

Explore penetration testing
Remediation

Help to fix findings

Help control owners understand the findings, plan the fixes and improve their evidence for reassessment.

Delta

Change and reassessment

Assess big changes, new parts of a service, and the updates needed when the ISM changes during a long assessment.

Advisory

Government framework alignment

Line up system security with the ISM, PSPF, Essential Eight and your own risk needs.

Explore security assessments

Assessed against the latest relevant ISM.

The IRAP Common Assessment Framework says assessors must use the latest ISM release available before the assessment starts, or a later one.

If an assessment runs across two ISM releases, a delta assessment against the current version is needed.

Check your IRAP readiness

  • Latest ISM baseline

    We use the most recent ISM release that applies when the work starts, or a later one.

  • Evidence over intention

    Assessors judge what is built and working, not controls that are only planned.

  • A clear boundary

    What is in and out, the environments, service dependencies, offshore access and shared controls must all be written down.

  • Objective reporting

    Findings must rest on evidence and explain their limits. They must not claim certification, compliance or authorisation.

Systems and services at SECRET and below.

ASD-endorsed IRAP assessors can assess a range of government and industry systems.

ICT systems

Government and business systems

Apps, infrastructure, networks, endpoints and the processes that support them, inside the set boundary.

Cloud services

Cloud providers and their services

The basics of cloud security, single cloud services, shared duties, service regions and what each one depends on.

Gateways

Cross-domain and connectivity services

How the gateway is built, filtered, watched and run, and the controls behind it.

GovLink

Government connectivity

Help for groups and services that link to the relevant Australian Government networks.

When an IRAP assessment is required.

Australian Government policy says some outsourced IT and cloud services must be IRAP-assessed before they store or process government information.

Government and agency buyers

Evidence for the decision to approve a system.

An IRAP report shows a system’s strengths and weak spots and how well its controls work. That helps you decide whether to accept the risk and let the system go live.

  • PROTECTED and SECRET environments
  • OFFICIAL and OFFICIAL: Sensitive systems
  • Outsourced technology services
  • Buying and reassessing cloud services
  • Risk-informed authorisation
Cloud and technology providers

Show government customers how secure you are.

Providers can use an IRAP assessment to give government buyers detailed proof of the controls in place and how secure their services are.

  • Cloud security assessment reports
  • Service and control matrices
  • Shared-responsibility documents
  • Data sovereignty and offshore access
  • Reassessment after major change

Clear evidence for technical teams and executives.

The IRAP report should clearly describe the system, the boundary, the methods and the evidence. It should set out strengths, weaknesses, how well controls work and any limits on the conclusions.

  • Security Assessment Report

    The system-level story. It explains the design, scope, findings, weak spots, testing, limits and recommendations.

  • Control matrix

    Notes for each control: how it is built, how well it works, how it was assessed, the evidence and who shares responsibility.

  • Findings

    Clearly lists controls that don’t work, vulnerabilities, alternate controls and gaps in the evidence.

  • Decision support

    Objective facts so you can weigh the risk that remains and make your own call on approval.

An IRAP assessment is not certification or approval.

IRAP assessors do not accredit, certify, endorse, approve or authorise systems for ASD. Your organisation and its authorising officer must still read the report and decide if the risk that remains is acceptable.

A controlled path from scope to final report.

Each step is based on evidence of what is in place today, not on controls that are only planned.

  1. Step 1: Plan

    Confirm the goals, frameworks, stakeholders, any conflicts of interest, timing and how we will run the assessment.

  2. Step 2: Set the boundary

    Confirm the systems, services, environments, data classifications, locations, links to other systems, shared controls and what is left out. Check the design and which controls apply.

  3. Step 3: Collect evidence

    Review the design, policies, settings, records and other working papers. Gather more through interviews, checks and technical tests.

  4. Step 4: Assess the controls

    Decide whether each control that applies works well, does not work, is inherited from another provider or is covered by an alternate control.

  5. Step 5: Report

    Prepare the Security Assessment Report and control matrix, with the strengths, weaknesses, evidence and limits, for stakeholders to review.

  6. Step 6: Improve

    Help control owners understand the findings, plan the fixes and build the evidence needed for reassessment and future risk decisions.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.