When you engage an IRAP Assessor you:
- should clearly define the scope of work and expected deliverables, and
- must not define favourable assessment outcomes because this jeopardises the integrity of the assessment.
If you are engaging an IRAP Assessor to:
- recertify a system, you should allow sufficient time to ensure the assessment can be completed before the current certification expires, or
- recertify a PROTECTED ASD Certified Gateway, you should engage the IRAP Assessor approximately three months before the current certification expires.
ASD recommends seeking at least three quotes when engaging an IRAP Assessor. Note ASD does not recommend specific IRAP Assessors nor assist in selecting an IRAP Assessor for a particular task.
Do not restrict engagement to those IRAP Assessors geographically located closest to you.