IRAP Assessment Process Explained

The Infosec Registered Assessors Program gives organisations access to ASD-endorsed ICT professionals who conduct independent security assessments. An assessor identifies applicable controls from the Information Security Manual, evaluates their effectiveness and reports security strengths, weaknesses and recommendations.

IRAP is not a certification program. Assessors do not accredit, certify, endorse or register systems on behalf of ASD, and they do not grant an Authority to Operate.

Assessment planning establishes the system boundary, information classification, hosting environment, interfaces, dependencies, assessment objectives and applicable ISM controls. Ambiguity here can make otherwise sound evidence irrelevant or leave important components outside the assessment.

The assessor reviews material that describes how the system should operate: the System Security Plan, architecture, policies and procedures, risk records, Essential Eight evidence, configuration standards and security design documentation. Documents need to match the implemented production environment.

Evidence may include configuration outputs, screenshots, system records, technical artefacts, policies, logs, interviews and demonstrations. Useful evidence is current, attributable to the assessed system and sufficient to support a finding.

Claims are tested in practice. Depending on scope and approvals, validation can include observing configurations, sampling systems and accounts, reviewing logs, tracing administrative processes and confirming that documented controls operate consistently.

The assessor evaluates applicable controls within the agreed scope and Australian Government requirements. The outcome depends on evidence of implementation and effectiveness; it is not a checklist assertion that a control exists.

Findings record control effectiveness, security weaknesses, associated risks and recommendations. The Security Assessment Report gives system owners and authorising decision-makers evidence for risk decisions. The assessor provides the assessment; the responsible organisation makes its authorisation decision.

Teams can address identified gaps through technical, procedural or documentation changes. Where required, reassessment confirms whether the new implementation resolves the original finding and is operating across the assessed scope.

Start by defining the boundary, making documentation current and organising evidence. Our IRAP preparation guide explains the work in more detail, and the IRAP readiness checklist helps teams review common evidence areas.