IRAP Readiness Consultant Sydney

Overview

What this service does

An IRAP assessment is an independent review of your system against the Australian Government Information Security Manual (ISM) by an assessor endorsed under the Infosec Registered Assessors Program. Agencies ask for one before they will host their data on your platform or connect you to their networks. The assessment itself must be independent, so we do not perform it. We get you ready for it.

Readiness means knowing what the assessor will ask for before they ask: which ISM controls are in scope, which ones you meet, which ones you do not, and the evidence that proves each answer. We run that process with you, close the gaps, and assemble an evidence pack so the assessment runs to plan rather than stalling on missing documents.

Parliament House and the flag mast reflected in Lake Burley Griffin at sunset

What's included

Scope of the engagement

Scoping: the system boundary, classification level and the ISM controls that apply
Control mapping and a gap register against the current ISM release
Gap closure plan with owners, effort and sequencing
System security plan, security risk management plan and incident response plan
Evidence pack: policies, configurations, screenshots and records organised by control
Assessor liaison and support during the assessment
Remediation of findings and preparation for the agency's authorisation decision

Who it's for

Right for you if

SaaS and managed-service providers hosting Commonwealth data
Contractors connecting to agency networks or handling PROTECTED information
Organisations that have been asked for an IRAP assessment in a tender or contract

FAQ

IRAP assessment readiness: common questions

Can you do the IRAP assessment as well as the preparation?

No, and you should be wary of anyone who offers both. The assessment must be independent of the people who built and prepared the system. We prepare; an IRAP assessor assesses.

How long does readiness take?

For a well-managed cloud service, three to six months from scoping to assessment-ready. Systems with little existing documentation take longer, mostly in building the evidence base.

Does ISO/IEC 27001 certification count?

It helps, because many ISM controls overlap with ISO 27001 Annex A, but it does not replace an IRAP assessment. We map the overlap so you reuse evidence rather than producing it twice.