IRAP assessments
IRAP assessments and cyber security assurance for Defence and government.
An IRAP assessment is an independent review of an ICT system's security against the Australian Government's controls, carried out by an ASD-endorsed assessor.
WHAT IS AN IRAP ASSESSMENT?
An IRAP assessment is an independent evaluation of how well a system meets the controls in the Information Security Manual. Through the Infosec Registered Assessors Program, ASD endorses cyber security professionals to deliver high-quality, independent security assessments.
It is worth being clear about what it is not. An IRAP assessment does not accredit or certify a system; it documents what was tested and the residual risk, so your accreditation authority can make the call. That distinction matters, and a good assessor makes it explicit.
What does Arrpwere's cyber assessment and assurance cover?
We support the whole lifecycle, not just the formal assessment, so gaps are found and closed before they become findings. Each service can be delivered on its own or as part of an end-to-end engagement.
When do you need an IRAP assessment?
You typically need one when a system stores, processes or communicates Australian Government information, or when a buyer requires it before awarding work. For many cyber and cloud providers, an IRAP assessment is a practical prerequisite for winning public-sector contracts.
Because ISM controls apply according to the classification of the data involved, the right scope depends on your system and its data. We help you define that scope so the assessment answers the question your buyer or authority is actually asking.
| Service | What it does |
|---|---|
| Security health check | Rapid, prioritised view of your current security posture |
| Gap analysis | Identifies where you fall short of the ISM or your target controls |
| IRAP readiness | Prepares your system and evidence before a formal assessment |
| Independent IRAP assessment | ASD-endorsed assessment of your controls against the ISM |
| Essential Eight maturity assessment | Measures maturity against the Essential Eight |
| Accreditation support | Helps your authority reach a confident accreditation decision |
| Post-implementation assurance | Confirms controls remain effective after go-live |
How does Arrpwere approach IRAP and assurance?
Our assessments are led by certified IRAP assessors, supported by specialists across governance, architecture, assurance and accreditation. We run the full path, from security health checks and gap analysis through IRAP readiness, independent IRAP assessments, ISM alignment and accreditation support, to post-implementation assurance, so you are not stitching together separate providers at each stage.
Independence is preserved throughout, because an assessment is only useful if it is objective. Our IRAP assessors are also security-cleared, which is a requirement of the program and reflects the classified environments we work in: ASD requires IRAP assessors to hold a Negative Vetting Level 1 clearance.
IRAP assessments and cyber security assurance for Defence and government
For Defence and government, who assesses your systems is part of the risk calculation. Arrpwere is a 100% Indigenous-owned, Supply Nation certified and DISP-member provider, certified to ISO/IEC 27001:2022 and ISO 9001, with a network of AGSVA-cleared professionals including TSPV-cleared resources.
That combination lets us assess inside classified programs, support your procurement diversity obligations, and draw on cleared ICT and cyber talent through Arrpwere People when an engagement needs to scale. If you need an IRAP assessment or an independent view of your security posture, talk to our cyber team.
Frequently asked questions
What is an IRAP assessment? It is an independent assessment of an ICT system’s security against the Information Security Manual, conducted by an ASD-endorsed IRAP assessor. It documents what was tested and the residual risk so an accreditation authority can make an informed decision.
Does Arrpwere have certified IRAP assessors? Yes. Arrpwere Cyber has certified IRAP assessors and delivers IRAP readiness and independent IRAP assessments, alongside Essential Eight maturity assessments and ISM alignment.
Does an IRAP assessment mean my system is accredited? No. An IRAP assessment does not accredit or certify a system. It provides the evidence and residual-risk picture your accreditation authority uses to decide.
Do your assessors hold security clearances? Yes. ASD requires IRAP assessors to hold at least an NV1 clearance, and our specialists work across classified environments up to higher clearance levels.
THE ARRPWERE CYBER ASSURANCE LIFECYCLE
The Arrpwere Cyber Security Assessment helps organisations identify their cyber security posture and obtain a tailored cyber resilience strategy, giving them the confidence and capability to deal with increasing risk.
Our comprehensive assessment allows organisations to identify potential gaps and risks in their environment so they can ultimately implement a cost-effective cyber security plan. We are able to provide a customised cyber resilience approach by taking into account an organisation’s unique risk profile and understanding the digital assets at stake.
In developing the framework and methodology for the Arrpwere Cyber Security Assessment, we have combined international information security standards with best practice processes in cyber security, risk management, compliance, governance and people.
The Arrpwere Cyber Security Assessment is offered through Cyber Assurance Platform (CAP), an Arrpwere Cyber flagship system that provides a comprehensive view of an organisation’s cyber maturity, leading to a full Information Security Registered Assessors Program [IRAP] assessment.
NB: The Information Security Registered Assessors Program (IRAP) is an Australian Signals Directorate (ASD) initiative to provide high-quality information and communications technology (ICT) security assessment services to government.
For more info on the Arrpere Cyber Security Assessment process...
CASE STUDIES
Strategic Leadership
The Challenge
To effectively deliver on and ensure compliance with cyber security principles in a highly sensitive environment, the Australian Cyber Security Centre (ASCS) required leadership from a specialist with high-level skills and strategic vision.
The Approach
As an ASCS coordinator, Arrpwere personnel led teams and provided strategic direction to deliver whole-of-government information security policy and advice, deliver cryptographic services and coordinate responses to cyber security for systems belonging to government and systems of interest to government.
Threat Modelling
The Challenge
Defence Chief Information Officer Group (CIOG) required a cyber security program that was appropriately tested to ensure it would stand up against emerging cyber threat. Assessment of security products was also of concern.
The Approach
A threat modelling approach was proposed with focus on integration into current processes. The approach was delivered in four stages: assessment, development, delivery and management of a threat modelling cyber security program for military weapons projects, integrating the Single Information Environment in CIOG.
