ASD Registered IRAP Assessor 

Our ASD Registered IRAP assessors have deep experience across government agencies, defence contractors, financial services, and critical infrastructure.

• Security cleared to government standards.

• Certified professionals: ISO 27001 Lead Auditor, CISSP, CISA, and CISM.

• Hands-on expertise delivering assessments that are practical, timely, and aligned with ASD expectations.

Packages – Transparent IRAP Pricing 

We believe in clear, upfront IRAP assessment pricing to help you plan budgets confidently.

• Small / Simple System – from $39,999 (ideal for SaaS or hosted platforms needing IRAP readiness)

• Medium Environment – from $59,999 (covering multiple applications or services under one accreditation boundary)

• Complex / Large Enterprise – from $99,999+ (for high-sensitivity systems with extensive ISM control mappings)

Prices exclude GST. Final cost depends on system scope, controls, and environment size.

Our IRAP Assessment Process  (3 Simple Steps)

Our process follows the IRAP Common Assessment Framework to ensure nothing is missed: 

1. Discovery & Scoping

   • Define system boundaries, data classifications, and security obligations. 

2. Assessment & Evidence Review

   • Assess your environment against the ISM and PSPF using ASD’s IRAP methodology. 

3. Report & Recommendations

   • Deliver the official IRAP Assessment Report and Controls Matrix, with remediation advice for Authority to Operate (ATO) approval. 

Refer IRAP Common Assessment Framework for more details

IRAP vs Other Standards

Understanding IRAP in context helps decision-makers choose the right framework:

• IRAP vs ISO 27001 – ISO 27001 is international, IRAP is mandatory for systems processing Australian Government data.

• IRAP vs SOC 2 – SOC 2 is US-based, IRAP aligns with ASD’s ISM and PSPF.

• IRAP + Essential Eight – Together they form a maturity roadmap from baseline security to government-grade compliance.

FAQs – IRAP Assessment

How long does an IRAP assessment take?
Most IRAP assessments take 6–10 weeks, depending on system complexity and your readiness of evidence and documentation.

Does IRAP provide certification?
No – IRAP is not a certification. It provides independent assurance to support risk decisions and Authority to Operate (ATO) approvals.  IRAP Assessment Report and Controls Matrix will be provided at completion

Who needs an IRAP assessment?
Any organisation providing ICT systems or cloud services to Australian Government agencies or handling sensitive/regulated data.

What documents are required?
Typically (Guidance only) a System Security Plan (SSP), system risk management plan (SRMP) and register, Cyber incident response plan, Continuous management plan, SOA or SSP Annex and other evidence of control implementation against the ISM.