IRAP

The Infosec Registered Assessors Program (IRAP) is the Australian Signals Directorate's scheme for endorsing private-sector security assessors who evaluate systems against the Australian Government Information Security Manual (ISM) and related policy such as the Protective Security Policy Framework.

An IRAP assessment is the standard way a cloud service or system used by Australian government agencies has its controls independently examined at a classification level (OFFICIAL, OFFICIAL: Sensitive, PROTECTED, and above).

The assessor produces a report on which controls are implemented, alternative controls, and residual risks; the assessor does not certify or accredit, and the agency's authorizing officer makes the authorization decision using the report.

ASD retired its Certified Cloud Services List in 2020 and replaced it with cloud security guidance that puts the assessment report at the center of each agency's own decision.

In writing, a system owner preparing for an IRAP assessment needs a system security plan that addresses each applicable ISM control, a security risk management plan, an incident response plan, a continuous monitoring plan, an architecture and data flow description, and the operating evidence the assessor will sample.

Assessment reports are typically refreshed every two years or when the system changes materially, and agencies commonly require a report no older than 24 months.