IRAP Assessment Readiness

Our IRAP readiness service prepares cloud, SaaS and technology providers for an IRAP assessment against the Australian Government Information Security Manual (ISM), so the assessor spends their time confirming controls rather than discovering gaps. IRAP assessments may only be performed by assessors endorsed by the Australian Signals Directorate (ASD). Security Solution Consultants (SSC) does not perform IRAP assessments. We prepare you for one: scoping, ISM control mapping, gap remediation, evidence packs and liaison with the endorsed assessor you engage.

IRAP at a glance

Choosing your target classification

Australian Government information is classified as OFFICIAL, OFFICIAL: Sensitive, PROTECTED, SECRET or TOP SECRET. Most SaaS and cloud providers selling to Commonwealth agencies aim for PROTECTED: agencies handling PROTECTED information typically ask for an IRAP assessment at that level, and the Hosting Certification Framework requires PROTECTED systems to be hosted with certified providers. ISM controls are marked with the classifications they apply to, so the target level decides which controls are in scope. We help you choose the level your customers need and your service can sustain, rather than the highest one available.

IRAP, the PSPF and the Hosting Certification Framework

Three pieces of Commonwealth policy meet in most IRAP engagements, and they answer different questions.

• The PSPF. The Protective Security Policy Framework is set by the Department of Home Affairs and reviewed every year. Release 2026, issued on 1 July 2026, added policy on post-quantum cryptography transition planning, training on AI use and bring-your-own-device, and enables future Hosting Certification Framework reforms. It is the policy your government customers must apply.
• The ISM. ASD’s cyber security framework, and the benchmark an IRAP assessor tests against. Agencies apply it through their own risk management.
• The Hosting Certification Framework (HCF). Requires sensitive government data, whole-of-government systems and systems classified PROTECTED to be hosted with certified data centre and cloud service providers, at Strategic or Assured level. It looks at ownership, control and supply chain as well as security, and an IRAP report can be used as evidence in an HCF assessment. The framework is being reformed: registrations from new providers have been paused since 3 November 2025, and existing certified providers are not affected.

For most SaaS providers the practical question is where the service is hosted. If you build on a hyperscale cloud or a colocation provider, check its HCF certification level and the regions it covers, and confirm with your government customer whether your own service needs anything more while the reform is under way.

Our IRAP readiness services

• Scoping and system boundary. The components, data flows, interfaces, administrators and support locations in scope, the target classification, and the split of responsibility with your hosting provider.
• ISM control mapping. Every applicable control for your target classification mapped to an implementation statement, an owner and evidence, including controls inherited from an IRAP-assessed hosting or platform provider.
• Gap assessment and remediation. Current state tested against the mapping, gaps ranked by risk and effort, and hands-on help to close them, from Essential Eight hardening and logging to cryptography, personnel security and supply chain.
• Security documentation. The system security plan and the supporting incident response, continuous monitoring and remediation plans, written to describe what you actually do.
• Evidence packs. Evidence organised by control, with configuration exports, records and policies, so an assessor can sample quickly.
• Assessor selection and liaison. Help choosing an endorsed assessor from ASD’s list, agreeing scope and timing, answering queries during the assessment and tracking findings to closure.
• Staying assessable. Each quarterly ISM release checked against your mapping, so a reassessment is an update rather than a restart.

How IRAP readiness runs

1. Scope. Agree the system boundary, the target classification and the customers driving the requirement.
2. Map. Build the control mapping for the target classification and identify inherited controls.
3. Assess gaps. Test the current state against the mapping and agree a prioritised remediation plan.
4. Remediate. Close gaps with your engineers and write the documentation.
5. Readiness review. A walk-through that samples evidence the way an assessor would, so surprises surface while there is still time to fix them.
6. Hand over and support. Your endorsed assessor runs the assessment; we support your team, answer queries and help close any findings.

What slows an IRAP assessment down

Assessors charge for time, and most of the time lost in an IRAP assessment is lost to the same few problems. Readiness work is aimed squarely at them:

• An unclear boundary. Components, integrations or support tools that nobody placed in or out of scope until the assessor asked.
• Inherited controls with no evidence. Claiming a control from a hosting provider without its report, its scope or the ISM release it was assessed against.
• Documents that describe intent. A system security plan that says what should happen rather than what does, which the assessor then has to test line by line.
• Hardening gaps. Essential Eight mitigations such as application control, patching and multi-factor authentication only partly in place.
• Evidence that cannot be sampled. Screenshots without dates, logs nobody can retrieve, and configurations that changed after the evidence was taken.

IRAP for SaaS providers

SaaS providers are assessed against the same ISM, with a few problems of their own:

• Inherited controls. A hosting provider’s IRAP report covers its layer, not yours. Read its scope, classification and ISM release before you rely on it.
• Administrative access and support. Where your administrators and support staff are located, how their access is controlled and logged, and what access exists from offshore.
• Multi-tenancy. How customer data is separated, and how you demonstrate it.
• Change between assessments. Frequent releases and a quarterly ISM mean the assessed system and the running system drift apart unless change is controlled and recorded.
• Existing certifications. If you hold ISO/IEC 27001 or a SOC 2 report, many controls can be reused. We map them to the ISM so evidence is collected once.

Why work with SSC

• We are clear about our role: readiness, not assessment, so there is no conflict with the assessor you choose.
• SSC is certified to ISO/IEC 27001 and follows a Secure by Design approach, so we prepare evidence the way we prepare our own.
• Our consultants work every day with the Essential Eight and the ISM’s hardening guidance. See our Essential Eight assessments.
• The GRCLens IRAP module holds the ISM catalogue pinned to the release you are assessed against, the control mapping, connector-collected evidence and the findings register, so the work outlasts the assessment.

Related services: security certification and accreditation, Essential Eight compliance assessment, penetration testing, ISO 27001 implementation and cyber security services in Canberra.