IRAP Assessment: What It Is, How It Works and Who Needs One

If you sell a cloud or managed IT service to the Australian Government, an IRAP assessment is likely to come up early in procurement. Agencies use the assessment report to decide whether a system's security risks are acceptable.

You will often see "IRAP certified" in sales material, but the Australian Signals Directorate (ASD) treats that phrase as a misrepresentation of the program. This guide explains what an assessment covers and what it produces.

What is an IRAP assessment?

An IRAP assessment is an independent review of a system's security controls against the Information Security Manual (ISM), carried out by an assessor endorsed through the Australian Signals Directorate's Infosec Registered Assessors Program (IRAP). The assessor reports the system's security strengths and weaknesses so that a government authorizing officer can decide whether to accept the remaining risk.

ASD endorses individual cyber security professionals from the private and public sectors as IRAP assessors, and only they can conduct an IRAP assessment. To be endorsed, an assessor must be an Australian citizen, hold at least a Negative Vetting Level 1 (NV1) security clearance, hold recognized security and audit qualifications and pass the IRAP training course.

The ISM is ASD's cyber security framework of principles and controls for protecting information technology and operational technology systems. IRAP assessors use the latest ISM release available when an assessment begins. ASD notes that an IRAP assessment generally won't cover every ISM control, so readers need the report itself to see what was tested. Read more on ASD's IRAP page.

What does IRAP PROTECTED mean?

"IRAP PROTECTED" is shorthand for a system that has completed an IRAP assessment against the ISM's controls for PROTECTED information. ASD's recommended wording names the system and the classification level of the ISM controls it was assessed against. The level matters because each ISM control states which classifications it applies to.

IRAP assessors can assess systems that handle non-classified, OFFICIAL: Sensitive, PROTECTED or SECRET information. Under the ISM and the Protective Security Policy Framework (PSPF), TOP SECRET systems are assessed by ASD assessors or their delegates instead. For what each level means, see our guide to OFFICIAL: Sensitive and the PSPF classifications.

Why "IRAP certified" is the wrong term

ASD does not accredit, certify, endorse or register any system under IRAP. ASD's IRAP policy and procedures (June 2026) say that statements claiming IRAP certification, accreditation or authorization to operate misrepresent the program, and ASD will ask for them to be removed. ASD's IRAP brand guidelines give "IRAP Certified" as an example of incorrect wording and recommend saying that a platform has undergone an IRAP assessment.

The assessor doesn't approve the system either. IRAP assessors describe weaknesses and their potential impact but don't rate risks, because authorizing a system is the agency's decision.

How an IRAP assessment works

ASD's IRAP Common Assessment Framework, published in April 2025, sets out four stages for every assessment:

1. Plan and prepare: the assessor agrees objectives, timing and methods with the client, and lodges a conflict of interest declaration with ASD at least 7 business days before starting.
2. Define the assessment boundary: the assessor and the organization agree which systems, services and assets are in scope.
3. Assess the controls: the assessor gathers evidence, including documents, interviews and testing, to judge how effectively each ISM control is implemented.
4. Produce the report: the assessor writes up the findings and any recommendations.

What an IRAP assessment produces

The minimum deliverables are a security assessment report (or cloud security assessment report) and a controls matrix. The report is written for authorizing officers, system owners and risk owners. It covers the assessment boundary, strengths and weaknesses, control implementation and recommended remediation. The controls matrix records observations against each ISM control for technical staff.

Under PSPF Release 2026, the authorizing officer for systems from OFFICIAL: Sensitive to SECRET is the Accountable Authority or Chief Information Security Officer (CISO) of the entity that owns the system, or their delegate. That person weighs the report and decides whether to accept the residual risk.

IRAP assessment vs ISO/IEC 27001 vs SOC 2

These three forms of security assurance are often confused, but they answer different questions.

ISO/IEC 27001 certification and SOC 2 reports can support a supplier's security case, but neither replaces an IRAP assessment where the PSPF calls for an IRAP assessor.

Do you need an IRAP assessment?

The PSPF is mandatory for non-corporate Commonwealth entities. PSPF Release 2026 requires outsourced systems, cloud services and gateways handling OFFICIAL: Sensitive, PROTECTED or SECRET information to be assessed by an IRAP assessor. An agency's in-house systems can use its own assessor instead.

PSPF Requirement 0109 directs entities to use cloud service providers that have completed an IRAP assessment against the latest ISM within the previous 24 months. The ISM sets the same 24-month cycle for outsourced cloud services and managed service providers (controls ISM-1570 and ISM-1793). The requirements are on the PSPF annual release page, and the controls are in the ISM.

If you provide a cloud or managed service to a Commonwealth entity, expect to be asked for your IRAP assessment report and controls matrix. Other suppliers should check their contract, because the PSPF requires agencies to include proportionate security terms in procurement and outsourcing arrangements.

How IRAP relates to the Hosting Certification Framework

The Hosting Certification Framework (HCF) is a separate scheme, run by the Department of Home Affairs since it moved from the Digital Transformation Agency on 1 May 2023. An IRAP assessment tests security controls, while the HCF certifies cloud and data center providers on ownership, control, supply chain and access to government data. PSPF Release 2026 requires security classified information to be hosted with a service certified under the HCF or its successor, Hosting Certification Framework 2.

Where DekkoCORE fits

DekkoCORE, DekkoSecure's secure file sharing and collaboration platform, is IRAP assessed for Australian government information up to PROTECTED. It has been independently assessed against the ISM at PROTECTED level. For Australian customers, DekkoCORE is hosted in-country in Australia. See the DekkoCORE security and compliance page for details.

Common questions

Frequently Asked Questions