Skip to main content

Explainers

What Is IRAP? Australia's Information Security Assessor Program

IRAP endorses individual assessors, not vendors. Learn what an IRAP assessment report actually proves and what to ask for instead of a badge.

Solomon AmosPublished 26 Oct 20269 min read

If a vendor's trust centre claims to be "IRAP certified", that phrase is already a signal worth pausing on. IRAP, the Infosec Registered Assessors Program, does not certify vendors, products or platforms. It is an Australian Signals Directorate (ASD) scheme that endorses individual assessors to carry out independent security reviews against the Australian Government Information Security Manual (ISM). The output of that review is a written assessment report, scoped to one system at one point in time, not a logo or a pass or fail badge. Understanding that distinction changes what you should actually ask a vendor to produce.

What IRAP actually is

IRAP stands for the Infosec Registered Assessors Program. It is run by the Australian Signals Directorate, the agency responsible for the ISM, which sets the baseline security controls that Australian government systems are expected to meet. IRAP does not test software. It trains and endorses people, information security professionals who then carry out assessments of specific systems, usually cloud services or hosting environments, against the ISM controls relevant to a given classification level such as OFFICIAL or PROTECTED. The scheme exists because Australian agencies needed a consistent, independent pool of qualified assessors rather than relying on each vendor's own self-attestation.

This matters for buyers outside Australia too, because IRAP sits in the same family as other government cloud authorisation schemes covered in the All frameworks directory, including FedRAMP in the United States and ISMAP in Japan. Each one answers the same underlying question in a different way: can a government customer trust this system's security controls without doing the assessment itself. IRAP's answer is to endorse the assessor, not the outcome.

Who gets endorsed, and what they actually do

An IRAP assessor is a named individual who has applied to ASD, demonstrated relevant experience and technical knowledge, and been accepted onto ASD's public register. Endorsement is not permanent or automatic; assessors are expected to maintain currency and can be removed from the register. Most IRAP assessors work for consulting or audit firms and are engaged directly by a vendor or agency to assess a particular system, not to issue a blanket statement about an organisation as a whole.

During an engagement, the assessor reviews the system's architecture, policies and controls against the ISM, interviews staff, examines evidence, and documents findings including any gaps or compensating controls. The assessor does not grant an authority to operate. That decision sits with the government agency that intends to use the system, which reviews the assessment report and decides whether the residual risk is acceptable for its own purposes. This is a meaningfully different model from a certification body issuing a certificate under an accreditation scheme.

Diagram comparing an IRAP assessment report, a FedRAMP authorization package and an ISO 27001 certificate side by side
IRAP produces a report for one system; it is not a certificate or a pass or fail mark.

The output is a report, not a badge

An IRAP assessment report is a detailed document: scope, methodology, control-by-control findings, and a statement of residual risk. It names the assessor, the date of the assessment, and the exact system or environment reviewed. It does not come with a certificate number, a renewal date printed on a seal, or a logo a vendor can post on a marketing page. If a vendor shows only a badge and no scope statement, there is no public evidence behind the claim, and a buyer has no way to check what was actually reviewed or when.

The Infosec Registered Assessors Program (IRAP) endorses individuals to provide high quality cyber security assessment services to government and industry, assessing systems against the Australian Government Information Security Manual.

That framing, assessing a system rather than certifying an organisation, is the core thing buyers miss. A vendor can hold a genuinely strong IRAP assessment for one product in one region and say nothing meaningful about a different product or a different deployment. The IRAP framework page lists vendors with public evidence so you can see which specific systems have been through the process, rather than taking a homepage claim at face value.

How IRAP compares with other government cloud schemes

ProgrammeWho assessesWhat you getPortable certificate?
IRAPASD-endorsed individual assessorA written assessment report against the ISM, scoped to one systemNo, the report belongs to that system and that assessment date
FedRAMPAccredited Third Party Assessment Organisation (3PAO)An authorization package reviewed by an agency or the FedRAMP PMO, listed on the MarketplaceA Marketplace listing, labelled "FedRAMP Certified" under the 2026 Consolidated Rules
ISO/IEC 27001Accredited certification bodyA certificate against the management system standardYes, a certificate with a stated validity period
SOC 2Licensed CPA firmAn attestation report, Type I or Type IINo, a report rather than a certificate

How IRAP's output compares with other common government and commercial assessment schemes.

The FedRAMP registry is a useful comparison because it shows the opposite end of the spectrum: a centralised Marketplace listing with a status buyers can check directly, as explained in FedRAMP in 2026. IRAP has no equivalent public marketplace. The assessment report sits with the vendor and the agency that commissioned it, which is exactly why a buyer needs to ask for the document itself rather than trusting a summary claim.

Why "IRAP certified" is the wrong phrase

A familiar pattern

The IRAP labelling problem is the same one covered in There is no such thing as "SOC 2 certified". Both SOC 2 and IRAP produce reports written by an independent party, not certificates issued by an accreditation body. Saying a vendor is "IRAP certified" describes a program that does not exist; what exists is an assessor's report against the ISM, tied to a scope and a date.

This is not a pedantic distinction. A certificate implies an ongoing status that a certification body stands behind and can suspend. An assessment report is a point-in-time opinion. The system can change the day after the assessor finishes, and nothing automatically re-triggers a review. Vendors who understand this usually say something like "IRAP assessed" with a scope and date attached, which is accurate, rather than "IRAP certified", which overstates what the program provides.

What to ask for instead of a badge

  1. 1

    Ask for the report, not the logo

    Request the actual IRAP assessment report, or at minimum a summary that states the classification level assessed, such as OFFICIAL or PROTECTED.

  2. 2

    Check the assessor's name and endorsement status

    ASD maintains a public register of current IRAP assessors. Confirm the named assessor was endorsed at the time of the engagement.

  3. 3

    Confirm the exact scope

    An assessment of one product, region or environment does not extend to the vendor's entire platform. Ask which system the report covers.

  4. 4

    Check the date

    Assessments are a snapshot. Ask how long ago the review happened and whether any material changes have occurred since.

  5. 5

    Ask who accepted the risk

    IRAP assessors do not grant an authority to operate. Ask which agency, if any, reviewed the report and made a risk decision based on it.

These same questions apply beyond IRAP. The auditors and certification bodies page lists the firms and individuals who carry out these reviews across frameworks, which is a useful starting point when you need to confirm that a named assessor or body is real and currently accredited rather than self-described.

Where IRAP shows up on trust centres

Vendors selling into Australian government or regulated sectors sometimes list IRAP alongside other regional authorisation schemes on a single trust centre page. The card below shows how that typically looks in practice: look for the scope note and assessment date sitting next to the framework name, not a standalone certificate graphic, and compare it against neighbouring entries like FedRAMP or ISMAP to see whether the vendor treats every framework with the same level of detail.

Zoom logo

Zoom · Trust report

Collaboration · Public evidence as of 2 Nov 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 18 vendor-stated.

10 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Zoom publishes or offers, as of 2 Nov 2026.

  • Standard contractual clauses · On request
  • AI and data use policy · On request

1Security practices

Public statements from Zoom, shown as statements, not attestations, as of 2 Nov 2026.

  • Penetration testing · report available
A trust centre listing IRAP next to FedRAMP, GovRAMP, TX-RAMP, C5 and ISMAP, each needing its own scope check. Every line is a dated public record from the Data Privacy Framework list and Zoom's trust centre. A framework not shown means no public evidence was found, not that Zoom lacks it.CertReports

How to verify an IRAP claim quickly

  1. Search ASD's public assessor register for the named individual or firm cited by the vendor.
  2. Request the assessment report summary and check the classification level and system scope match what the vendor is selling you.
  3. Check the assessment date against the vendor's current architecture; a review from several years ago may not reflect today's system.
  4. Cross-reference with other frameworks the vendor claims, using how to read a trust centre as a general method for working through a mixed list of claims.
  5. If the vendor also claims FedRAMP, confirm the Marketplace listing directly using the method in how to verify a FedRAMP listing, since both schemes are frequently listed together but checked very differently.
Flow diagram showing ASD endorsing an assessor, the assessor reviewing a system against the ISM, and an agency making its own risk decision
ASD endorses the assessor; the agency, not ASD, decides whether to accept the risk.
1
report per engagement
scoped to one system, one classification level, one assessment date
0
certificates issued by the program
ASD endorses assessors; it does not issue a vendor-facing certification mark
2
parties in the decision
the assessor writes the report, the agency decides whether to accept the risk

People also ask

What is irap?

IRAP, the Infosec Registered Assessors Program, is an Australian Signals Directorate scheme that trains and endorses individual security assessors. Those assessors review specific government or commercial systems against the Australian Government Information Security Manual and produce a written assessment report, not a certificate or logo, for that one system at that point in time.

What is irap certification?

Strictly, there is no such thing. IRAP endorses assessors, it does not certify vendors or products. A vendor describing itself as "IRAP certified" is using inaccurate shorthand for having commissioned an IRAP assessor's report. Ask for the actual report, its scope and its date rather than accepting the phrase at face value.

What is irap assessment?

An IRAP assessment is the engagement itself: an ASD-endorsed assessor reviews a named system's architecture, policies and controls against the Information Security Manual at a specific classification level, such as OFFICIAL or PROTECTED, and documents findings and residual risk in a report used by the commissioning agency or vendor.

What is irap australia?

IRAP is specific to Australia. It is run by the Australian Signals Directorate and exists primarily to support Australian government agencies that need independent assurance before using a cloud service or system. Vendors outside Australia pursue it when selling to Australian government or regulated customers, alongside schemes like FedRAMP or ISMAP in other regions.

Is irap a certification?

No. IRAP is an assessor endorsement program, not a certification scheme for vendors or products. The deliverable is an independent assessment report against the ISM, reviewed by the agency using the system. There is no accreditation body issuing a vendor-facing certificate, so "IRAP certified" is not an accurate description of what the program provides.

IRAPAustraliaASDgovernment cloudassessor programs
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like