IRAP readiness, run end to end
From ISM gap assessment to assessor-ready: we close the control gaps, build the documentation and evidence, and coordinate your ASD-endorsed IRAP assessor through to the report. Fixed consulting fee agreed up front.
What is IRAP?
The Infosec Registered Assessors Program (IRAP) is run by the Australian Signals Directorate (ASD) through the Australian Cyber Security Centre. ASD-endorsed IRAP assessors independently assess systems against Information Security Manual (ISM) controls, for systems up to SECRET, helping entities meet Protective Security Policy Framework requirements. Assessors do not accredit systems: they produce a security assessment report that the agency's authorising officer uses to make the accreditation decision.
Who this is for
When IRAP readiness is the ask
IRAP is usually a procurement requirement before it is a security one. If any of these sound familiar, this is the engagement.
A government tender or contract requires an IRAP assessment of your system.
You are a SaaS or cloud provider pursuing Australian Government customers at OFFICIAL: Sensitive or PROTECTED.
Your platform will store, process or transmit government data, and agency security teams are asking for a current assessment.
An agency's authorising officer wants independent assurance before granting an Authority to Operate.
Procurement questionnaires keep asking about ISM controls, and each answer takes days of evidence hunting.
What you receive
What the engagement includes
Everything your endorsed assessor will ask for, built and evidenced before they arrive.
Scope & classification
A defensible system boundary and target data classification, matched to what your government customers will actually put in the system. Scope is the decision that most affects assessment cost, and a narrow, defensible one assesses faster.
ISM gap assessment
Your current controls benchmarked against the Information Security Manual controls that apply at your target classification, ranked by what blocks the assessment, what carries real risk, and what is merely tidy.
Security documentation
The System Security Plan, threat and risk assessment and incident response procedures written for your system rather than a template. These are the documents the assessor reads first.
Control implementation & evidence
ISM controls implemented with named owners, and evidence collection set up so it survives assessor testing, not just the project. Assessors test that controls operate, not that policies exist.
Team preparation
Your engineers and security leads prepared for assessor walkthroughs and evidence requests, so the fieldwork weeks run on answers rather than follow-ups.
Assessor coordination
We help you shortlist ASD-endorsed IRAP assessors by sector experience and availability, brief the one you engage, and manage evidence requests and responses through to the final report.
The process
How the engagement runs
Typical elapsed time from kick off to assessor-ready is three to six months, depending on the target classification and your starting point. Endorsed assessor booking lead times affect the end date, so we shortlist early.
Weeks 1–2
Scoping & gap assessment
We define the system boundary and target classification, then benchmark your current state against the applicable ISM controls. The fixed-fee quote for the readiness build follows from this.
Months 1–3
Remediation & documentation
Controls implemented with your team and your IT provider rather than around them, alongside the System Security Plan, threat and risk assessment and incident response procedures.
Months 3–4
Evidence & readiness review
Evidence packs assembled per control, an internal review run the way the assessor will run theirs, and gaps closed while they are still cheap to close.
Booking window
Assessor engagement
You engage the ASD-endorsed IRAP assessor directly. Endorsed assessor lead times affect the end date, so we shortlist early and brief the assessor you pick.
Assessment window
Assessor fieldwork & report
The assessor tests the controls and produces the security assessment report. We coordinate evidence and responses throughout, then help you address findings for the agency's authorisation decision.
Assessments follow ASD's Common Assessment Framework, which standardises the methodology assessors use across cloud, gateway and on-premises systems. We prepare your evidence to that methodology, so nothing about the fieldwork is a surprise.
Pricing
What IRAP readiness costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
The total cost of getting assessed has three lines, and only one of them is ours: our fixed consulting fee, the endorsed IRAP assessor's assessment fees (paid to them, varying by assessor and scope), and your own team's time. Preparation is where the leverage sits: a system that arrives assessor-ready spends fewer billable days in fieldwork.
The consulting fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan against the applicable ISM controls and a fixed quote for the readiness build. If you want a read on where you stand first, the free gap self-assessment takes a few minutes.
Independence
The assessment is independent. The preparation is ours.
Only ASD-endorsed IRAP assessors can perform an IRAP assessment, and the two roles are kept separate so the report means something. CyberNinja does not perform or issue IRAP assessments, and we do not employ IRAP assessors. Our job is preparation: ISM control implementation, documentation, evidence, and coordination with the endorsed assessor you engage directly.
The assessor's report goes to the agency's authorising officer, who makes the accreditation or Authority to Operate decision. Because we never sit on both sides of the table, the report your assessor issues carries its full weight with the agency. We help you shortlist assessors by sector experience, scope fit and booking availability against your procurement deadline, then brief the one you pick.
Why CyberNinja
Why organisations choose us
ISM and PSPF fluency
We work in the Information Security Manual and the Protective Security Policy Framework daily, so the controls are built the way an endorsed assessor will test them.
Government procurement experience
We know what agency security teams and authorising officers ask for, and we build the documentation to answer it the first time.
Independent advice
We hold no reseller agreements, take no vendor margin, and never perform the assessment ourselves. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the gap assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Want the program detail first? Our IRAP framework guide explains who needs an assessment and what it covers, and IRAP implementation: your questions answered works through the questions teams ask before they start.
FAQ
IRAP readiness FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to sell to government?
Tell us which agency or tender is asking and when they need it. We will scope the readiness work and give you a fixed price, so you know the cost before you commit.