irap

IRAP - Information Security Registered Assessors Program

IRAP is the Australian Signals Directorate's programme that registers independent assessors to evaluate ICT systems and services against the Information Security Manual (ISM). The current authoritative methodology is the IRAP Common Assessment Framework (CAF) v1.0, April 2025, which replaced the earlier IRAP assessment process guide.

An IRAP assessment is not a certification. IRAP assessors do not certify, accredit, endorse, register or authorise systems. They identify security strengths and weaknesses so that an authorising officer can make a risk-based authorisation decision.

The minimum deliverables of an IRAP assessment are:

• IRAP Security Assessment Report (or IRAP Cloud Security Assessment Report) intended for authorising officers, system owners and risk owners.
• Controls Matrix (or Cloud Controls Matrix) intended for technical personnel and system administrators.

When to use this skill

• The user is preparing for, or responding to, an IRAP assessment.
• The user is writing an SSP, an SoA, a security risk management plan, or other Stage 1 inputs the assessor will request.
• The user is mapping shared responsibilities between a cloud or SaaS provider and the consumer agency.
• The user is reading an existing IRAP report from a provider and asking what to inherit, what to verify and what is theirs to implement.
• The user is preparing for an authorising officer's risk-based decision based on an IRAP report.
• The user is asking about a specific IRAP Assessment Requirement (IRAP-AR-XXXX).
• The codebase or estate contains artefacts the assessor will sample: IaC, IdP exports, monitoring config, DevSecOps pipelines, evidence packs.

What this skill knows

• The four CAF stages: Plan and prepare, Define the assessment boundary, Assess the controls, Produce the IRAP assessment report.
• The 46 IRAP Assessment Requirements (IRAP-AR-0001 through IRAP-AR-0046) grouped under the CAF's seven quality standards (Report quality and terminology, Assessment process and frameworks, Evidence gathering, Coverage, Objectivity, Technical accuracy and completeness, Assessment integrity). See ./quality-standards.md.
• The seven implementation outcomes and the rules around their use. See ./implementation-outcomes.md.
• The four-tier evidence quality model (Excellent, Good, Fair, Poor) and the assessment-degree matrix (Basic, Focused, Comprehensive). See ./evidence-quality.md.
• The four sampling methodologies (Random, Stratified, Risk-based, Systematic). See ./sampling.md.
• The distinction between assessment boundary and authorisation boundary, and layered assessments. See ./boundaries.md.
• The mandatory Conflict of Interest declaration to ASD IRAP via the Partner Portal, submitted at least 7 business days before commencement (IRAP-AR-0008 and -0009), and the obligation to update it throughout the engagement (IRAP-AR-0010).
• The role of the system authoriser (the agency that authorises the system based on the IRAP outcome) and the explicit prohibition on the assessor rating risk or making authorisation statements (IRAP-AR-0033, IRAP-AR-0041).
• The ISM-release-handling rule: use the latest ISM at start (IRAP-AR-0014); if 2 ISM releases lapse during the engagement, conduct a delta assessment (IRAP-AR-0015).