IRAP

IRAP is ASD's Infosec Registered Assessors Program. ASD endorses individuals from the private and public sectors to provide independent security assessment services. Assessors help organisations understand strengths and weaknesses and recommend mitigations. They assess SECRET and below for ICT systems, cloud services, gateways, and GovLink. TOP SECRET cloud and systems stay with ASD security assessors or their delegates.

What IRAP does not do matters as much as what it does. ASD's IRAP page is explicit: assessors do not accredit, certify, endorse, or register systems on behalf of ASD. A completed assessment does not imply the system is compliant with every tested control, and the scope will generally not cover all ISM controls. The consumer guide and the report are what you buy. A logo on a slide is not.

Authorisation to operate stays with the system owner. Under the PSPF, the Authorising Officer accepts residual security risk before a technology system processes, stores or communicates government information. An IRAP report feeds that decision; it does not make it. If the vendor will not show residual risks, consumer recommendations, and what was out of scope, you have marketing, not assurance.

For Commonwealth use of outsourced IT and cloud, PSPF still drives when IRAP is required. Non-corporate Commonwealth entities subject to the PGPA Act must apply the PSPF. PSPF Table 21 / consumer-guide mapping expects SECRET, PROTECTED, OFFICIAL: Sensitive and OFFICIAL outsourced IT and cloud services to be IRAP-assessed before processing government data. PSPF Secure Cloud Strategy requirement 0109: Cloud Service Providers must have had an IRAP assessment within the previous 24 months against the latest ISM at the time of assessment. On-premises government systems at SECRET and below can be assessed by an entity assessor or an IRAP assessor.

Cloud cycle from ASD's cloud assessment and authorisation FAQ: IRAP assessment of CSPs and their cloud services at least every 24 months, or when events force a revalidation, using a current ISM. Focus reassessments on security-related changes since the last report and on new services. A report older than 24 months is not automatically void — but age raises the chance it is stale. Confirm with the CSP that the contents are still accurate, ask for addendums, and check whether the assessment boundary still matches the region and services you buy. International certifications (FedRAMP and the rest) do not replace an IRAP assessment against the ISM. Reuse evidence from other schemes only where it is applicable, accurate, and valid for the same boundary.

The Cloud Services Certification Program and the Certified Cloud Services List are gone (ceased March and July 2020). There is no current ASD 'certified cloud' stamp to hide behind. Ask for the IRAP report or cloud security assessment report (ASD templates exist for both), the assessment date, the classification intended, the residual-risk table, consumer recommendations (lockbox, region lock, logging you must turn on), and what was out of scope. A two-year-old report on a different region or a subset of services is a starting point, not a current control.

On the desk: pick an endorsed assessor from ASD's list, fix the assessment boundary in writing before fieldwork, and read the letter of completion against your shared-responsibility split. Buying an IRAP-assessed service does not move residual risk to the provider. Pair with the ISM page, Essential Eight evidence, and third-party / supply chain when the same vendor holds identity, backups, or personal information.