IRAP readiness assessments for Australian government suppliers

• Review of security controls against the ASD ISM
• Identification of readiness gaps and implementation shortfalls 

• Aligning governance, risk, and compliance structures to ISM requirements
• Clarifying control ownership and accountability 

• Identification of residual security risks
• Risk-based prioritisation of remediation actions 

• Reviewing and uplifting security policies and procedures
• Ensuring documentation meets IRAP assessor expectations 

• Reviewing shared responsibility models
• Assessing supplier and cloud service alignment 

• Translating IRAP readiness into business risk language
• Supporting executive decision-making prior to assessment 

IRAP assessments are high-quality risk-based security assessments conducted by an IRAP assessor. They play a key role in an organisation’s decision to authorise a system for use or operation. Specifically, they assist an authorising officer in identifying and understanding the security risks associated with the use of the system. 

The Directive on Security of Government Business establishes the Protective Security Policy Framework (PSPF) as Australian government policy. The PSPF is owned and developed by the Department of Home Affairs. 

Non-corporate Commonwealth entities that are subject to the Public Governance, Performance and Accountability Act 2013 must apply the PSPF (to the extent consistent with legislation).  

PSPF Table 21 () requires that SECRET, PROTECTED, OFFICIAL: Sensitive and OFFICIAL outsourced information technology and cloud services must be IRAP-assessed prior to processing and storing government data. In addition, PSPF 15.2 Secure Cloud Strategy requirement 0109 states that Cloud Service Providers must have had an IRAP assessment within the previous 24 months against the latest ISM at the time of assessment. 

Taking the time and effort to conduct an IRAP readiness assessment will significantly improve your organisations chances of successfully passing IRAP certification. Knowing your possible gaps in policy and procedure will allow for effective remediation prior to any assessment.

An IRAP readiness assessment vastly reduces the risk of your organisation failing an IRAP assessment. Without the readiness assessment, you will have 

• Reduced knowledge of your Cyber security environment.
• No knowledge of the gaps in your policy and procedures.
• A lack of understanding of the possible issues with your assessment of your Cyber security posture.
• A heightened risk of wasting time and money on an assessment that ultimately fails. 
• A high risk of reputational damage

• Cyber security incident management policy
• Cyber security documentation
• System hardening
• System monitoring
• Guidelines for cryptography 

An IRAP readiness assessment will provide your organisation with all the information and knowledge needed to allow for a successful IRAP certification. Without this readiness assessment, your organisation risk wasting time, money and ultimately failing of the assessment.