How to become an IRAP Assessor

IRAP Assessors are ICT professionals endorsed by the Australian Signals Directorate (ASD). IRAP Assessors have experience and qualifications in ICT security assessment and risk management, and a detailed knowledge of ASD’s Information Security Manual.

IRAP Assessors are required to meet the following requirements prior to enrolling in the IRAP Course and exam (these requirements are vetted by ASD's training providers prior to course acceptance):

• demonstrated Australian citizenship
• demonstrated a minimum of five (5) years in information security roles utilising relevant Australian security frameworks such as the Information Security Manual (ISM) Protective Security Policy Framework (PSPF) and supporting publications
• shown evidence of relevant ICT and auditing qualifications, one from Category A and one from Category B

Category A

• CISM - Certified Information Security Manager
• CISSP - Certified Information Systems Security Professional
• GSLC - GIAC Security Leadership Certificate

Category B

• CISA - Certified Information Systems Auditor
• CRISC
• GSNA - GIAC Systems and Network Auditor * GSNA will no longer be accepted after 31/12/2026 *
• ISO 27001 Lead Auditor * ISO 27001 will no longer be accepted after 31/12/2026 *
• PCI QSA

Once an applicant successfully completes the IRAP course and Assessment, they can apply for IRAP endorsement. Applicants must apply to the program within 3 months of course exam result notification.

All IRAP Assessors are required to maintain a minimum NV1 clearance. Applicants may be sponsored by ASD as a part of the application process. 

If the candidate successfully meets all of the above criteria, and the professional and integrity standards required for ASD endorsement, they are added to the list of registered IRAP Assessors.

In accordance with the IRAP Policy and Procedures, IRAP Assessors maintain their skills and endorsement by:

• demonstrating maintenance of contemporary ISM and IRAP assessment knowledge on a 24 month basis by completing IRAP renewal requirements
• ensuring a conflict of interest declaration is submitted to ASD prior to each IRAP assessment
• attending ASD-endorsed workshops, forums and conferences
• participating in information-sharing activities across the IRAP and information security communities, and
• demonstrating behaviours of professionalism and integrity consistent with ASD Values.

IRAP Assessors make a valuable contribution to Australia's national security objectives by assisting government agencies to improve their security posture by providing ICT security advice and assessment services.