IRAP Assessment

Your gateway to the Australian government market

IRAP has shifted from a competitive advantage to a strict baseline requirement for doing business with Australia’s public sector. A-LIGN brings local IRAP expertise and Australian delivery resources under the same roof as your SOC 2 and ISO 27001 program, one partner, every framework Australia requires.

Talk to an expert

Why A-lign

One partner for IRAP, SOC 2, and ISO 27001

IRAP is an independent assessment of your security controls against the Australian Government's Information Security Manual (ISM). It's now a mandate for cloud service providers and a critical requirement for any company pursuing government or municipal contracts in Australia, one of the most tightly regulated markets in the Asia-Pacific region.

Get started

Local expertise, global standards

Australian-based practitioners leverage A-LIGN's audit methodology, sharpened across 36,000+ engagements worldwide, giving you local credibility backed by global rigor.

Compliance as a growth driver

As you expand across Australia and the broader APAC region, A-LIGN's depth across frameworks scales with you. IRAP's control set overlaps with ISO 27001 and SOC 2. A-SCEND maps shared requirements so your evidence does more than one job.

Align with government expectations

IRAP is crucial for organizations aiming to work with Australian government agencies. It signals a commitment to protecting sensitive data and complying with regulatory frameworks.

OUR SERVICES

IRAP services for every stage

A-LIGN's IRAP assessments are delivered by ASD-endorsed assessors against the Australian Government Information Security Manual (ISM) and Protective Security Policy Framework (PSPF), so your report holds up to government and enterprise scrutiny.

IRAP Readiness Assessment

Evaluates your controls against the ISM before the formal assessment begins, surfacing gaps while there’s still time to fix them.

IRAP Security Assessment

An independent, ASD-aligned assessment of your system’s security controls, covering classifications up to SECRET.

Security Assessment Report & SCM

A four-stage delivery: plan and prepare, define scope, assess controls, and produce your report and security controls matrix.

Reassessment & Ongoing Compliance

PSPF requirement 0109 expects a current IRAP assessment within the prior 24 months. We help you stay ahead of the renewal window.

audits completed

36k+

customer satisfaction

96%

clients globally

6.4k+

auditors globally

400+

Platform Innovation

Modernized compliance makes rigor repeatable

A-SCEND combines human expertise and robust processes with powerful technology to help you achieve compliance, grow your business, and expand into new markets without sacrificing rigor.

A-SCEND platform showing centralized audit requests

A-SCEND platform showing the guided audit workflow stages

EFFICIENT AUDIT PLATFORM

Tech-enabled audit management

A-SCEND is an end-to-end audit management platform built from real-world audit practice. By eliminating repetitive tasks, delivering real-time visibility and control, and enforcing consistency and precision across every engagement, A-SCEND elevates audit quality without sacrificing rigor.

Purpose-built technology enforces consistency, strengthens audit quality, and drives efficiency, every cycle, every framework, every year.

RIGOROUS METHODOLOGY

Precision at every stage

Every A-SCEND engagement follows a disciplined methodology built to withstand scrutiny.

That rigor carries through every stage of our audit process, from precise scoping and a deep understanding of your business up front, with executive oversight and built-in quality checks, to expert review and fine-tuning for a polished, high-quality report.

That experience and discipline bring greater certainty and help prevent the leading causes of report rejection: incomplete scope and missing controls.

Helpful Resources

Support for your compliance journey

From guides to whitepapers, we've got the resources to move your compliance program forward.

View resources

resource Video ISO 42001 virtual workshop 1 0

What is IRAP and why does it matter?

IRAP (Information Security Registered Assessors Program) is an Australian Signals Directorate initiative that provides independent assessment of an organization's security controls against the Australian Government's Information Security Manual (ISM). It has become mandatory for cloud service providers and a critical requirement for companies pursuing government and municipal contracts in Australia.

Who needs an IRAP assessment?

Cloud and SaaS providers hosting government workloads, and any vendor bidding on Australian federal, state, or local government contracts. The trigger is the buyer and the data involved, not company size — a small SaaS vendor handling government data carries the same obligation as a hyperscaler.

Do we need IRAP if we already have SOC 2 or ISO 27001?

Likely yes, if you're pursuing Australian government business — IRAP is assessed against the ISM specifically, which Australian agencies require regardless of other certifications. The good news: IRAP's control set overlaps substantially with SOC 2 and ISO 27001, so much of your existing evidence can be reused rather than rebuilt.

How long does an assessment take, and how often do we need to reassess?

Timelines vary with scope, but assessments follow four stages: plan and prepare, define scope, assess controls, and produce the report and security controls matrix. Under PSPF requirement 0109, agencies expect a current IRAP assessment completed within the prior 24 months, so reassessment is a recurring part of maintaining eligibility.

Does A-LIGN have assessors based in Australia?

Yes. Through our acquisition of AssurePoint, A-LIGN now has local, ASD-endorsed IRAP practitioners and delivery resources based in Australia, combined with A-LIGN's global audit methodology.

SOC Assessments

ISO Certifications

Federal Assessments

Healthcare Assessments

Cybersecurity

Privacy

PCI Assessments

Additional Services

Quick links

By service

Featured Resources