IRAP consumer guide
An IRAP Assessor will assist you by helping you to understand and implement security controls and recommendations to protect your systems and data.
Infosec Registered Assessors Program (IRAP)
Access high-quality security assessment services through IRAP.
About the program
An IRAP security assessment can help you understand your system’s security strengths and weaknesses. It can also provide recommendations for your organisation’s security program.
IRAP assessors can help you to secure your organisation’s systems and data by independently:
- assessing your cyber security posture
- identifying security risks
- suggesting mitigation measures.
They can also provide security assessments for systems and services handling information classified as SECRET and below for:
We endorse individuals from the private and public sectors to provide security assessment services. This is to:
- strengthen the security of industry and Australian Government systems and data
- help entities meet their requirements set by the Protective Security Policy Framework (PSPF).
Learn how to become an IRAP assessor.
Assessment scope and limitations
IRAP assessors do not accredit, endorse or register systems on our behalf.
IRAP security assessments will generally not cover all security controls outlined in the Information Security Manual. Completion of an assessment doesn’t mean the system is compliant with the tested security controls.
It’s vital to read and understand the security assessment reports or letters of completion to determine what a system has been tested against, and if it meets your needs.
For organisations
Find information and resources to help your organisation understand, prepare for and undertake an IRAP assessment.
For IRAP Assessors
Find information and resources on branding and marketing, IRAP policies and templates for conducting assessments.
For prospective IRAP Assessors
Find information and resources if you are interested in becoming an IRAP assessor.
