IRAP Assessments

Independent assessments against the Australian Government Information Security Manual. Conducted by an ASD Endorsed IRAP Assessor.

What is an IRAP assessment?

An Information Security Registered Assessors Program (IRAP) assessment is an independent security review of an information system against the requirements of the Australian Government Information Security Manual (ISM). It is conducted by an assessor endorsed by the Australian Signals Directorate (ASD).

Government agencies use IRAP assessments to support their decision to authorise a system or cloud service. Cloud service providers seeking to handle government information at OFFICIAL or PROTECTED classification levels typically need an IRAP assessment before agencies will engage them.

An IRAP assessment is not a certification or accreditation. It produces an independent report that the consuming agency uses to make an informed risk acceptance decision.

Who needs an IRAP assessment?

Government agencies: Commonwealth and state agencies are required to assess systems handling Australian Government information. IRAP assessments are often required before an agency can authorise a new system or a significant change to an existing system.

Cloud service providers: Technology companies handling government data at OFFICIAL Sensitive or PROTECTED levels are typically required to have an IRAP assessment in place before an agency will grant them access. This includes SaaS platforms, infrastructure providers, and managed service providers seeking government contracts.

Who conducts the assessment?

Gaurav Vikash is an ASD Endorsed IRAP Assessor — one of a limited number of independent assessors on the ASD register. All assessments are conducted directly by Gaurav.