Infosec Registered Assessors Program (IRAP)

For those providing—or wanting to provide—cyber security assessment services to the Australian government, you must undergo the Information Security Registered Assessors Program (IRAP), which involves a rigorous security assessment performed by an IRAP assessor.

What is IRAP?

In Australia, IRAP is the cornerstone of ensuring information and communication technology (ICT) systems across government agencies are secure and compliant with the Australian Government Information Security Manual (ISM).

In providing a comprehensive framework for independent security assessments, IRAP plays a pivotal role in enhancing the protection of national data. Governed by the Australian Cyber Security Centre (ACSC), it sets the standard for cloud service security assessments and endorses skilled professionals to deliver top-tier cybersecurity evaluation services.

Benefits of IRAP

Getting IRAP assessed offers a multitude of benefits for organizations handling government data or aiming to work with Australian government agencies, including:

Access to Government Contracts

An IRAP assessment can open up new business opportunities, as it’s often a prerequisite for organizations seeking to provide services to Australian government agencies.

https://www.schellman.com/hubfs/improve-security.png

Enhanced Security Posture

An IRAP assessment identifies potential vulnerabilities and provides recommendations for strengthening the security of your ICT systems, which will improve your overall resilience against cyber threats.

https://www.schellman.com/hubfs/meet-compliance-requirements.png

Assessment Confidence

Successfully undergoing an IRAP assessment ensures your systems are aligned with the Australian Government ISM which sets high standards of data protection and security practices.

https://www.schellman.com/hubfs/staff-awareness.svg

Expert Guidance

Working with experienced IRAP assessors gives organizations access to deep cybersecurity expertise that can aid in your navigation of complex security challenges and regulatory landscapes.

Improved Risk Management

Through its comprehensive assessment process, IRAP helps organizations identify and mitigate security risks, preventing potential breaches and data loss incidents.

Our IRAP Process

As specialists in scrutinizing security measures against the Australian Government ISM standards, our IRAP assessors aim to help you enhance the protection of governmental data across ICT infrastructures for storage, processing, and communication.

To do this, we begin each project with your end goals in mind as we prepare for future key project activities. Timely coordination of project planning activities, as well as effective communication throughout the engagement, are central to our methodology with our clients, which breaks down as follows:

Scope Definition

First, we’ll define the scope of your IRAP assessment, which involves identifying the specific systems, data, and operations that will be evaluated against the ISM standards before confirming that scope with our certified IRAP Assessor.

Security Documentation Review

After compiling your organization's security documentation, policies, and procedures, we will review this necessary evidence to ensure everything aligns with ISM requirements.

Assessment

The assessor will then conduct evaluations—including interviews with key personnel and physical inspections of your ICT infrastructure—so that you receive a comprehensive assessment of your security measures and practices.

Remediation and Action Plans

Based on the assessment findings, your organization will document the actions required to implement security measures and to remediate identified vulnerabilities in your Plan Of Action And Milestones (POAM).

Reporting

We will then compile a detailed IRAP Assessment Report that outlines the scope of the assessment, your current security status, identified risks, and recommendations for mitigating these risks, which will enable any reviewer of the report to make an informed risk-based decision about your system’s suitability for their security needs and risk appetite.

Follow-up Assessment (Optional)

After you implement the recommended improvements, we can conduct a follow-up assessment to ensure that all changes are effectively mitigating risks and that your organization is aligned with ISM standards.

Connect with a Schellman specialist.

We are a trusted provider to the world’s leading companies with a service delivery model which allows for optimum quality and client experience for organizations of every size and complexity.

Talk with a Specialist