IRAP Assessment Services

As an ACSC endorsed IRAP Assessor, we are pleased to offer a range of IRAP services. With extensive experience conducting IRAP Assessments for Federal Government clients, we provide comprehensive services including IRAP Assessments, ISM Implementation and Support, and Advisory Services.

Our expertise ensures that organisations meet the highest standards of information security and compliance. Whether you need a thorough assessment or guidance on implementing security measures, we are here to support your needs.

Benefits of IRAP Services

IRAP: Strengthening Security, Ensuring Compliance, Building Trust.

Regulatory Compliance

Ensures adherence to the Australian ISM for government and sensitive data.

Reduced Risk

Minimizes threats by assessing and addressing security gaps.

Boosted Credibility

Builds trust with stakeholders by demonstrating cybersecurity commitment.

Continuous Improvement

Provides insights for ongoing security enhancements and maturity.

Stages of an IRAP Assessment

Stage 1 - Plan and prepare

The IRAP assessor informing the ASD IRAP Administrator, via [email protected]. of the IRAP engagement by submitting a Conflict of Interest (COI) declaration form.
The IRAP assessor conducting engagement planning activities. These activities require the assessor to determine in consultation with the client organisation the commencement date, milestones, version of the ISM and access to resources.
IRAP assessors may develop a security assessment plan to document this information and share it with the client organisation.

Stage 2 – Define the scope of the assessment

The scope of an IRAP assessment includes both the authorisation boundary of the system under assessment, as well as the security controls applicable to the assessment of that system. The scope of an IRAP assessment should be defined early in the assessment by the IRAP assessor coming to an agreement with the System Owner on system version, environment, and the intended security classification.
The client organisation may already have a view of the scope of an assessment; however, it is the IRAP assessor’s responsibility to validate the accuracy of the scope.
The scope of the assessment should be clearly articulated within the security assessment report. Any system components or environments deemed out-of-scope should also be documented and accompanied by a justification for its exclusion from the assessment.

Stage 3 – Assess the security controls

In this phase, the IRAP assessor reviews evidence provided by the client organisation to determine the implementation status of security controls. Security control review activities are typically divided into two categories:

Design effectiveness review: The assessor reviews the documented system (i.e. system architecture, security policies, procedures, plans, etc.) and determines whether relevant controls have been scoped for the system and unique risks to the system have been addressed. Personnel interviews may also be required at this stage to confirm the accuracy of documentation and/or fill gaps in poor documentation. The design effectiveness review provides the assessor with an understanding of the system and its security controls and provides the foundation for further control validation activities.
Operational effectiveness review: The assessor conducts control validation activities to determine whether the documented security controls have been implemented and are operating effectively. The determination of operational effectiveness requires a combination of personnel interviews, live demonstrations of systems and security controls, system testing and site inspections (if applicable). Operational effectiveness review provides a higher level of assurance on the implementation of a security control and whether it can be assessed as effective.

Stage 4: Produce the security assessment report and security controls matrix

Upon the completion of the assessment, the assessor produces a security assessment report to document the outcomes of the assessment. At a high-level, a security assessment report describes:
- The scope of the security assessment.
- The effectiveness of the implementation of security controls.
- Security risks associated with the operation of the system.
- Any recommended remediation actions.
IRAP assessors are not required to undertake a risk assessment of ineffective controls, only identify security risks and risk mitigating controls so that the consumer of the report can undertake their own assessment of those risks. IRAP assessors should only describe identified risks and should not rate risks on behalf of report consumers. It is up to the consumer of the report to determine the level of risk exposure within their environment.
In addition to the security assessment report, the IRAP assessor documents the security controls matrix (SCM) or cloud SCM (CSCM).
IRAP deliverables are required to follow the guidance provided by ACSC on ACSC IRAP Resources.

Partner with the Expert Team Your Business Deserves.

Our dedicated professionals deliver tailored solutions to help your business thrive, ensuring you get the expertise and support you deserve every step of the way.