Compliance | IRAP Readiness
IRAP readiness,
done properly.
IRAP is where most Australian SaaS and cloud vendors meet the Information Security Manual for the first time, and it's where a lot of them stall. We prepare PROTECTED-bound systems for an ASD-endorsed IRAP Assessor, close the gaps before Stage 2, and stay alongside you through the authorising authority's decision to operate. We are not IRAP assessors. We are the team that gets you ready for one.
An independent review of a system against the ISM, not a certification.
The Information Security Registered Assessors Program (IRAP) is run by the Australian Signals Directorate through the ACSC. The ACSC endorses individual assessors, who then review a system against the Australian Government's Information Security Manual (ISM) at a target classification, most commonly OFFICIAL or PROTECTED.
An IRAP Assessor does not certify, accredit, or approve a system. They produce a Security Assessment Report and a Security Controls Matrix that document how the system meets, partially meets, or does not meet each applicable ISM control. That report is then handed to the system owner and the authorising authority, who decide whether to grant an Authority to Operate (ATO).
The most common misconception is that IRAP is the outcome. IRAP is an input to a risk decision. The ATO is the outcome. A clean-looking IRAP report that the agency's authorising authority rejects is still a failure.
Without an IRAP report, you don't sell to Australian Government at PROTECTED.
Federal agencies, state governments, Defence primes, and an increasing number of critical infrastructure operators require a current IRAP report before they'll approve your SaaS or cloud service for PROTECTED workloads. In many cases, that requirement flows down to your prime contractors and partners too.
The commercial lock-out is real. SaaS vendors without a PROTECTED IRAP report are routinely disqualified at shortlist stage on Commonwealth and state tenders. Recent changes under the Cyber Security Act 2024 and the Hosting Certification Framework have tightened the posture further for cloud providers.
Talk to us about your IRAP planWe don't do the assessment. We get you ready for it.
The ACSC endorses individuals as IRAP Assessors, not firms. Cliffside does not currently have endorsed assessors on our staff, and we won't pretend otherwise. Most consultancies that advertise IRAP services quietly subcontract the actual assessment anyway. We think that's worth saying out loud.
Where we add value is in the 90% of the programme that sits either side of the assessor's involvement: scoping the system, designing controls that meet ISM requirements, building the evidence base, remediating the gaps between Stage 1 and Stage 2, and helping the authorising authority say yes.
Our consultants have been certified ISO 27001 Lead Auditors since 2008, hold Essential Eight assessor credentials, and have delivered security programmes for Commonwealth and state government clients. The ISM builds on the same foundations, and most of our clients find that getting their ISO 27001 ISMS in shape first de-risks the IRAP assessment substantially.
When you're ready for the formal assessment, we help you select an ASD-endorsed assessor, brief them properly, and manage the engagement. If an assessor has recommended you already, we can slot in around their timeline.
- ✓IRAP readiness gap assessment against ISM controls
- ✓System scoping and classification targeting
- ✓Control design, uplift, and hardening
- ✓Evidence base construction
- ✓Pre-assessment dry run using ISM controls
- ✓Assessor shortlist, briefing, and engagement
- ✓Between-stages remediation
- ✓Residual risk narrative for the ATO authority
- ✓Ongoing ISM alignment and 24-month re-assessment prep
- ✗The formal IRAP assessment itself
- ✗Issue the Security Assessment Report
- ✗Grant your ATO (only the authorising authority can)
How an IRAP assessment runs
The five stages, from scoping to re-assessment.
The formal assessment is built around two reviews: design (Stage 1) and implementation (Stage 2). The work that surrounds them is where most engagements succeed or fail.
Agree the system boundary, classification target (usually PROTECTED), and which ISM controls apply. Scope errors at this stage cost the most to fix later, because every in-scope component has to be assessed.
The IRAP Assessor reviews the system's design documentation, policies, and planned controls against the ISM. This is where architectural gaps surface. Findings are documented and you get time to remediate before the implementation review.
The assessor reviews the deployed system: configurations, operational controls, evidence, and logs. Controls that looked fine on paper at Stage 1 frequently fail here because the build drifted from the design.
The assessor produces the SAR and Security Controls Matrix. These are handed to the system owner, who presents them to the authorising authority for a risk-based decision to operate (ATO) at the target classification.
PROTECTED IRAP reports are typically refreshed every 24 months, with delta re-assessments for material changes. Agencies increasingly ask for recent reports; an IRAP from 2022 carries less weight than one from 2025.
If any of these describe you, IRAP is probably on your roadmap.
IRAP is triggered by who you sell to and what data you handle, not by your size. Startups and multinationals both end up in the same PROTECTED queue.
Any SaaS platform that will store, process, or transmit PROTECTED information on behalf of a Commonwealth or state agency. Includes CRM, ticketing, analytics, collaboration, and increasingly AI tooling as agencies move workloads into managed services.
Trigger: a government tender that lists "current PROTECTED IRAP report" as mandatory, or a prime contractor passing the requirement down.
Infrastructure providers, managed service providers, and Australian regions of hyperscalers seeking placement on agencies' Certified Cloud Service Lists and alignment with the Hosting Certification Framework. The ISM bar is high and the evidence expectations are intense.
Trigger: pursuing Commonwealth hosting work, state government cloud panels, or Defence Industry Security Program engagement.
DISP members, critical infrastructure operators under the SOCI Act, and vendors in Defence supply chains where PROTECTED handling is expected. IRAP sits alongside DISP membership and SOCI obligations, and the three increasingly converge at assessment time.
Trigger: a DISP membership renewal, a SOCI risk management programme requirement, or a Defence prime requiring ISM-aligned evidence.
Common findings
Where IRAP assessments actually fail.
Across dozens of readiness engagements, the same findings appear again and again. Fixing them before an ASD-endorsed assessor arrives is far cheaper than fixing them between Stage 1 and Stage 2 with an invoice meter running.
ISM requires specific event classes to be logged, retained, and reviewed. Most SaaS vendors log application events but miss authentication, privileged activity, and security-relevant configuration changes, or cannot prove review. This is one of the most common non-compliant findings at Stage 2.
ISM references the ASD Approved Cryptographic Protocols and Algorithms. Default TLS configurations, KMS settings, and at-rest encryption choices often fall outside the approved set, particularly for legacy components. Fixing this in production retrospectively is painful.
ISM requires personnel with access to PROTECTED systems to hold an Australian Government security clearance at the appropriate level. Offshore support staff, contractor access, and third-party engineers are where most vendors discover they have a problem.
PROTECTED systems generally must be hosted on a Certified Cloud Service List provider in Australian regions. If your system or any dependency sits outside Australia, the ATO decision becomes much harder, regardless of how well the controls are implemented.
ISM controls are not satisfied by policy statements; they need evidence of operation. Change tickets, patching records, vulnerability scan outputs, incident drills, access reviews. Vendors routinely arrive at Stage 2 with controls in place but no evidence they've been operating. The assessor cannot accept 'trust us'.
Six months into readiness, a new feature ships, a new integration goes live, or a region expands. Every uncontrolled change risks dragging new components into scope. Without a scoping and change governance discipline, assessments that looked 90% done suddenly aren't.
How Cliffside helps
Our IRAP-readiness engagements.
We structure engagements around your target assessment date and the authorising authority's expectations. Every phase has a deliverable; every deliverable has a purpose the assessor will recognise.
A structured review of your system against the ISM controls that apply at your target classification. We produce a prioritised findings list, remediation roadmap, and honest assessment of how realistic your target date is. Typically two to four weeks. Included within a Lighthouse Assessment if IRAP is your stated goal.
We work alongside your engineering and security teams to close the findings. Logging architecture, cryptography hardening, personnel processes, evidence collection, and change governance. We build the controls so they actually operate, not just so they look right on paper for the assessment.
Before you engage an ASD-endorsed assessor, we run a dry-run assessment using the same ISM controls and evidence standards a real IRAP Assessor will apply. Most of our clients would rather fail the dry run with us than fail Stage 2 with an external assessor on the clock.
We help you shortlist, brief, and engage an ASD-endorsed IRAP Assessor. During the assessment, we act as the technical counterparty so your engineering team stays building, and we own remediation of any findings that emerge between Stage 1 and Stage 2.
A Security Assessment Report is the input to the authorising authority's risk decision, not the decision itself. We help you translate assessor findings into a clear residual risk narrative, supporting documentation, and the Letter to the ATO Authority that makes acceptance more likely.
PROTECTED means continuous compliance, not a point-in-time event. We run internal audits, monitor control effectiveness, manage delta changes, and prepare you for 24-month re-assessments so your ATO stays current with minimal engineering disruption.
Frequently asked questions.
What is an IRAP assessment?
Is Cliffside an ASD-endorsed IRAP Assessor?
How long does an IRAP assessment take?
How much does an IRAP assessment cost in Australia?
Do we need IRAP if we already have ISO 27001?
What classifications does IRAP cover?
What happens if the IRAP report shows non-compliance with ISM controls?
Tell us honestly where you are.
Tell us your target classification, your commercial deadline, and what state your controls are in. We'll give you an honest read on timeline, cost, and whether you're ready to engage an ASD-endorsed assessor now or six months from now. No obligation.