Evaluate security controls against strict government standards.
IRAP Assessment Services
As an ACSC‑endorsed IRAP Assessor, we deliver trusted IRAP assessment and advisory services to support government and regulated organisations. With extensive experience conducting IRAP assessments for Federal Government clients, we provide end‑to‑end support including IRAP assessments, ISM implementation, and ongoing advisory services.
Our expertise helps organisations meet stringent information security requirements, reduce risk, and demonstrate compliance with the Australian Government’s Information Security Manual (ISM). Whether you require a full IRAP assessment or guidance to uplift your security posture, we’re here to support you.
Benefits of IRAP Services
IRAP Assessment Steps
Step 1: Plan and Prepare
We formally notify the ASD IRAP Administrator and complete conflict‑of‑interest requirements. Engagement planning is conducted in collaboration with your organisation, covering timelines, milestones, ISM version, system access, and resources. A security assessment plan may be developed to guide the engagement.
Step 2: Define the Scope
The assessment scope is clearly defined and validated, covering the system’s authorisation boundary, applicable security controls, environment, system version, and security classification. Any exclusions are documented and justified in the assessment report.
Step 3: Assess Security Controls
We evaluate control effectiveness through:
- Design Effectiveness Reviews – Assessing documentation, architecture, policies, procedures, and risk alignment.
Operational Effectiveness Reviews – Validating real‑world implementation through interviews, system demonstrations, testing, and inspections (where applicable).
Step 4: Reporting and Deliverables
Upon completion, we deliver a Security Assessment Report outlining:
- Assessment scope
- Control implementation effectiveness
- Identified security risks
- Recommended remediation actions
We also produce the Security Controls Matrix (SCM) or Cloud SCM (CSCM) in line with ACSC IRAP requirements. Risk ratings remain the responsibility of the report consumer, ensuring independent risk decision‑making.