Compliance | IRAP Assessment
Your IRAP assessment,
done properly.
A tender needs a current PROTECTED IRAP report and you need to know how far off you are. If your system is ready, our ASD-endorsed IRAP Assessors assess it. If it isn't, we get it ready and an independent assessor from another firm assesses it. Either way, you get a straight answer on timeline and cost before you commit.
Four situations. Each needs something different.
Most organisations come to IRAP from one of these positions. Find yours and you'll know whether you need an assessment now, readiness work first, or help getting through an assessment already under way.
Your controls are built, documented, and operating, and you can prove it with evidence. What you need now is an ASD-endorsed IRAP Assessor to run Stage 1 and Stage 2 and produce the report your authorising authority will rely on.
You get: a formal IRAP assessment by our ASD-endorsed IRAP Assessors, with the Security Assessment Report and Security Controls Matrix. Available if we haven't worked on the system.
A contract depends on it, the deadline is fixed, and nobody can tell you whether that deadline is realistic. Booking an assessment now risks a long findings list and paying for the assessment twice.
You get: a readiness gap assessment, a prioritised roadmap, and an honest view on your date. When the system is ready, an independent assessor from another firm assesses it.
Stage 1 surfaced more than you expected and Stage 2 is weeks away. Your engineers need someone who knows what an assessor will accept as evidence, without slowing the product roadmap.
You get: remediation support between stages, working around your assessor's timeline. Because we're shaping the fixes, we can't also be your assessor for that system.
PROTECTED reports are typically refreshed every 24 months, and material changes to the system can trigger a delta assessment. Agencies give less weight to an old report than to a recent one.
You get: a re-assessment by our assessors if we haven't shaped the system, or readiness for the re-assessment if we have.
An independent review of a system against the ISM, not a certification.
The Information Security Registered Assessors Program (IRAP) is run by the Australian Signals Directorate through the ACSC. The ACSC endorses individual assessors, who then review a system against the Australian Government's Information Security Manual (ISM) at a target classification, most commonly OFFICIAL or PROTECTED.
An IRAP Assessor does not certify, accredit, or approve a system. They produce a Security Assessment Report and a Security Controls Matrix that document how the system meets, partially meets, or does not meet each applicable ISM control. That report is then handed to the system owner and the authorising authority, who decide whether to grant an Authority to Operate (ATO).
The most common misconception is that IRAP is the outcome. IRAP is an input to a risk decision. The ATO is the outcome. A clean-looking IRAP report that the agency's authorising authority rejects is still a failure.
Without an IRAP report, you don't sell to Australian Government at PROTECTED.
Federal agencies, state governments, Defence primes, and an increasing number of critical infrastructure operators require a current IRAP report before they'll approve your SaaS or cloud service for PROTECTED workloads. In many cases, that requirement flows down to your prime contractors and partners too.
The commercial lock-out is real. SaaS vendors without a PROTECTED IRAP report are routinely disqualified at shortlist stage on Commonwealth and state tenders. Recent changes under the Cyber Security Act 2024 and the Hosting Certification Framework have tightened the posture further for cloud providers.
Talk to us about your IRAP planThe firm that prepares you shouldn't assess you.
ASD's IRAP Policy and Procedures says a conflict of interest arises when the assessor, or anyone they share a corporate affiliation with, has influenced the system being assessed. That includes documentation, mitigation advice, and implementation guidance, and it applies even when the work was done by a separate team, in a different location, or at an earlier time. ASD's consumer guide names an initial gap assessment and design recommendations as examples.
This matters to you, not just to the assessor. Every IRAP Assessor must declare conflicts to ASD before the assessment starts. If ASD isn't satisfied, the assessment can't proceed, and a conflict found part way through can force the assessor to stop, hand over to someone else, or abandon the assessment. ASD isn't liable for your costs when that happens, and your tender deadline doesn't move.
So for any one system we do readiness or the assessment, never both. We have ASD-endorsed IRAP Assessors on our team: if your system is ready and we haven't touched it, they can assess it. If it isn't ready, we prepare it and an independent assessor from another firm does the assessment. Ask any provider offering both on the same system how they would answer ASD.
Our consultants have been ISO 27001 Lead Auditors since 2008, hold Essential Eight assessor credentials, and have delivered security programmes for Commonwealth and state government clients. If you already run an ISO 27001 ISMS, much of your IRAP evidence base exists already. Our breakdown of how IRAP compares to ISO 27001 covers where the two overlap and where they don't.
- ✓IRAP readiness gap assessment against ISM controls
- ✓System scoping and classification targeting
- ✓Control design, uplift, and hardening
- ✓Evidence base construction
- ✓Pre-assessment dry run using ISM controls
- ✓Between-stages remediation
- ✓Residual risk narrative for the ATO authority
- ✓Ongoing ISM alignment and 24-month re-assessment prep
- ✓Formal IRAP assessment (Stage 1 and Stage 2) by ASD-endorsed IRAP Assessors
- ✓Security Assessment Report and Security Controls Matrix
- ✗Assess a system it helped prepare
- ✗Promise your ATO (only the authorising authority decides)
- ✗Call your system "IRAP certified" (IRAP doesn't certify)
Cost and timeline
What an IRAP assessment costs, and how long it takes.
These are typical ranges for a PROTECTED-level SaaS or cloud system. Your numbers depend on scope and on how ready you are when the assessor arrives, which is why we start by telling you where you stand.
Typical assessor fees for a PROTECTED-level IRAP assessment. The spread comes from how many components are in scope, how many ISM controls apply, and how mature your evidence is when the assessor arrives.
The formal Stage 1 and Stage 2 reviews, depending on system complexity and how quickly your team can produce evidence. Findings between the two stages are the usual reason this stretches.
From deciding you need IRAP to holding a usable Security Assessment Report, for most SaaS vendors. Readiness, remediation, and evidence building take most of that time, and they often cost as much as the assessment itself.
How an IRAP assessment runs
What happens to your system, from scoping to re-assessment.
Your formal assessment is built around two reviews: design (Stage 1) and implementation (Stage 2). The work that surrounds them is where most assessments succeed or fail.
Agree the system boundary, classification target (usually PROTECTED), and which ISM controls apply. Scope errors at this stage cost the most to fix later, because every in-scope component has to be assessed.
The IRAP Assessor reviews the system's design documentation, policies, and planned controls against the ISM. This is where architectural gaps surface. Findings are documented and you get time to remediate before the implementation review.
The assessor reviews the deployed system: configurations, operational controls, evidence, and logs. Controls that looked fine on paper at Stage 1 frequently fail here because the build drifted from the design.
The assessor produces the SAR and Security Controls Matrix. These are handed to the system owner, who presents them to the authorising authority for a risk-based decision to operate (ATO) at the target classification.
PROTECTED IRAP reports are typically refreshed every 24 months, with delta re-assessments for material changes. Agencies increasingly ask for recent reports; an IRAP from 2022 carries less weight than one from 2025.
If any of these describe you, IRAP is probably on your roadmap.
IRAP is triggered by who you sell to and what data you handle, not by your size. Startups and multinationals both end up in the same PROTECTED queue.
Any SaaS platform that will store, process, or transmit PROTECTED information on behalf of a Commonwealth or state agency. Includes CRM, ticketing, analytics, collaboration, and increasingly AI tooling as agencies move workloads into managed services.
Trigger: a government tender that lists "current PROTECTED IRAP report" as mandatory, or a prime contractor passing the requirement down.
Infrastructure providers, managed service providers, and Australian regions of hyperscalers seeking placement on agencies' Certified Cloud Service Lists and alignment with the Hosting Certification Framework. The ISM bar is high and the evidence expectations are intense.
Trigger: pursuing Commonwealth hosting work, state government cloud panels, or Defence Industry Security Program engagement.
DISP members, critical infrastructure operators under the SOCI Act, and vendors in Defence supply chains where PROTECTED handling is expected. IRAP sits alongside DISP membership and SOCI obligations, and the three increasingly converge at assessment time.
Trigger: a DISP membership renewal, a SOCI risk management programme requirement, or a Defence prime requiring ISM-aligned evidence.
Common findings
Where IRAP assessments actually fail.
The same findings come up again and again. Fixing them before an ASD-endorsed assessor arrives is far cheaper than fixing them between Stage 1 and Stage 2 with an invoice meter running.
ISM requires specific event classes to be logged, retained, and reviewed. Most SaaS vendors log application events but miss authentication, privileged activity, and security-relevant configuration changes, or cannot prove review. This is one of the most common non-compliant findings at Stage 2.
ISM references the ASD Approved Cryptographic Protocols and Algorithms. Default TLS configurations, KMS settings, and at-rest encryption choices often fall outside the approved set, particularly for legacy components. Fixing this in production retrospectively is painful.
ISM requires personnel with access to PROTECTED systems to hold an Australian Government security clearance at the appropriate level. Offshore support staff, contractor access, and third-party engineers are where most vendors discover they have a problem.
PROTECTED systems generally must be hosted on a Certified Cloud Service List provider in Australian regions. If your system or any dependency sits outside Australia, the ATO decision becomes much harder, regardless of how well the controls are implemented.
ISM controls are not satisfied by policy statements; they need evidence of operation. Change tickets, patching records, vulnerability scan outputs, incident drills, access reviews. Vendors routinely arrive at Stage 2 with controls in place but no evidence they've been operating. The assessor cannot accept 'trust us'.
Six months into readiness, a new feature ships, a new integration goes live, or a region expands. Every uncontrolled change risks dragging new components into scope. Without a scoping and change governance discipline, assessments that looked 90% done suddenly aren't.
How we help
What you can engage us for.
Readiness work (01 to 03, 05 and 06) runs alongside an independent assessor from another firm. A formal assessment (04) is for systems we haven't helped prepare. Every deliverable has a purpose your assessor will recognise.
You find out how far your system is from the ISM controls that apply at your target classification. You get a prioritised findings list, a remediation roadmap, and an honest view on whether your target date is realistic. Typically two to four weeks. Included within a Lighthouse Assessment if IRAP is your stated goal.
Your engineering and security teams close the findings with us alongside them: logging architecture, cryptography hardening, personnel processes, evidence collection, and change governance. The controls are built to operate, not just to look right on paper for the assessor.
Before your formal assessment, you get a dry run against the same ISM controls and evidence standards an IRAP Assessor will apply. Failing a dry run costs you a few weeks. Failing Stage 2 with the assessment clock running costs a lot more.
Our ASD-endorsed IRAP Assessors run your Stage 1 design review and Stage 2 implementation review, then produce the Security Assessment Report and Security Controls Matrix your authorising authority needs to make its decision. Available for systems we have not helped prepare, so your report stands up to scrutiny.
Your Security Assessment Report is the input to the authorising authority's risk decision, not the decision itself. You get help turning the assessor's findings into a clear residual risk narrative and the supporting documentation that makes acceptance more likely.
PROTECTED is continuous, not a point-in-time event. Internal audits, control monitoring, delta changes, and preparation for your 24-month re-assessment keep your ATO current without pulling engineers off the roadmap.
Frequently asked questions.
What is an IRAP assessment?
How much does an IRAP assessment cost in Australia?
How long does an IRAP assessment take?
Is there such a thing as IRAP certification?
Can the same firm do our IRAP readiness and our IRAP assessment?
How do we choose an IRAP assessor?
Does Cliffside have ASD-endorsed IRAP Assessors?
Do we need IRAP if we already have ISO 27001?
What classifications does IRAP cover?
What happens if the IRAP report shows non-compliance with ISM controls?
Tell us honestly where you are.
Tell us your target classification, your commercial deadline, and what state your controls are in. You'll get an honest read on timeline and cost, and on whether you need an assessment now or readiness work first. No obligation.