IRAP Pulse - Be IRAP Ready. Always.

Running self-test… i On every page load the tool replays a known fixture (2 New / 2 Modified / 1 Rescinded) through the real delta engine. Green means the parser still matches expectations; red means ASD has likely changed the CCM schema and the output should not be trusted until the parser is updated.
Your uploaded files are processed locally in your browser. They are not uploaded anywhere.
⚠ Before you start
Focus on the intent of ISM requirements, not just the letter.

A common approach when completing a System Security Plan-Annex (SSP-A) is reading each control literally and marking it Not Applicable because the wording does not seem to fit. The ISM is outcome-focused - the intent of a control is as important as the precise phrasing or whether your organisation uses the exact terminology in the requirement.

Three things to keep in mind before you start:

  • Not meeting a control is different from that control not applying. Use Not Applicable only where there is a genuine architectural or organisational reason — for example, physical security controls for a system with no on-premises footprint.
  • Even where responsibility is delegated — to a cloud provider, a managed security service, or another team — the organisation retains accountability and must be able to demonstrate how that accountability is fulfilled.
  • Board-level controls apply to every organisation regardless of size. For example, if your organisation does not have a formal board of directors — a committee, leader, or individual with right authority may fulfil the intent of executive accountability for cyber security.

Template details

About this tool

About this tool

How this tool works

Load a blank ASD SSP-A template (bundled or your own upload), select your system classification and assessment scope, then download. The tool writes Not Applicable and a standard justification into every control excluded by your classification or scope. The implementation status of all other ISM controls remains as Not Assessed — for you or the IRAP assessor to update manually.

1. Inputs

  • SSP-A template: bundled (current quarter, auto-fetched) or your own ASD template
  • Classification: NC / OFFICIAL: Sensitive / PROTECTED / SECRET / TOP SECRET
  • Scope: which of the 22 ISM Guidelines apply to the assessed system

2. Process

  • Classification check: any control where the applicability column for your classification is "No" is marked Not Applicable
  • Scope check: any control under an unticked Guideline is marked Not Applicable; classification takes precedence where both apply
  • Comment written: a standard justification sentence is added to the Comments column for each marked control

3. Outputs

  • Pre-populated SSP-A (.xlsx): Updated spreadsheet with Not Applicable and justification added; all other ISM controls remain as Not Assessed without any comment
  • Principles sheet: not updated; all principles always apply
  • Info sheet: not updated; unfortunately, the tool can't always retain the format of the original file
What this tool does not do

This tool attempts to discern which ISM controls are not applicable to the assessed system. However, it cannot determine whether a control is genuinely applicable or not. You and the assessor still need to:

  • Assess every remaining control and record whether it is Implemented, Partially Implemented, Planned, or Not Implemented
  • Verify that every Not Applicable decision made here is defensible in the context of the actual system
  • Complete the Principles sheet/tab; it is not modified by this tool
  • Review and adjust scope or classification selections before finalising the SSP-A

Classification and scope selections are guiding principles — the outputs of this tool are starting points, not conclusions.

Assumptions the tool makes about the template
Assumption What goes wrong if untrue
The template follows the ASD SSP-A structure — a spreadsheet with ISM-XXXX identifiers and NC / OS / P / S / TS applicability columns. Column detection fails and the download button shows an error rather than producing an incorrect file.
Guideline names in the template match the names shown in the scope checklist exactly. Controls under mismatched Guideline names will not be marked Not Applicable even if the Guideline is unticked.
The template is blank — Implementation column values are "Not Assessed". Any cells already containing assessment decisions will be overwritten where a classification or scope exclusion applies.
Disclaimer and limitation of liability

This tool is provided on an “as is” and “as available” basis, without warranty of any kind. The output is a decision-support aid, not professional, legal, compliance, assurance or IRAP advice. Every Not Applicable decision produced by this tool must be reviewed and confirmed against the actual system under assessment. You remain solely responsible for the accuracy and defensibility of all Not Applicable determinations and for ensuring the final SSP-A meets your organisation’s assurance, accreditation and record-keeping obligations. To the maximum extent permitted by law, in no event shall Cybernion be liable for any direct, indirect, incidental, special, consequential or punitive damages arising from your use of this tool.

Security and transparency

This tool is a single HTML file with no server component, no backend, and no account or login requirement. Everything runs in your browser.

  • No data leaves your machine. Your SSP-A template and all selections are processed entirely in-browser. Nothing is transmitted to any server — not even Cybernion’s. The pre-loaded SSP-A template is fetched from a static file host at startup; no other network calls are made.
  • Third-party libraries. Two open-source JavaScript libraries are loaded at startup: xlsx-js-style v1.2.0 (Excel read/write) from jsDelivr, and PDF.js v3.11.174 (PDF parsing) from Cloudflare CDN. Both are pinned to exact versions with Subresource Integrity (SRI) hashes, so your browser will refuse to run them if the CDN serves a modified file.
  • Vulnerability scanning. This html tool and both JavaScript libraries were scanned against public vulnerability databases prior to release. No known vulnerabilities were identified at the versions pinned above.
  • Static resource review. The tool and its bundled assets were reviewed as static resources prior to publication. No active content, no dynamic code evaluation, and no third-party tracking scripts are present.
  • Source transparency. The full source of this tool is contained in this single HTML file. You can inspect it at any time in your browser’s developer tools or by opening the file in a text editor.
  • Bundled file integrity. Each time the tool loads, it computes a SHA-256 hash of the bundled SSP-A template in your browser and compares it against a known-good hash embedded in the HTML at release time. A “Verified” result confirms the file served to you is byte-for-byte identical to the file tested by Cybernion. A mismatch is flagged visibly. The expected hashes are updated in the source with each quarterly release.

If you identify a security concern, please Contact Us.

Licence and attribution

© 2026 Cybernion. All rights reserved. This tool is provided free of charge for use by security practitioners. No part of this tool may be reproduced, redistributed, or used to create derivative works without prior written permission from Cybernion. “ISM”, “IRAP” and related terms refer to work published by the Australian Signals Directorate / ACSC. This tool is an independent utility and is not endorsed by, affiliated with, or sponsored by ASD, ACSC or the Australian Government.