Australia IRAP - Information Security Registered Assessors Program IRAP-AR-0001: IRAP-AR-0001 Assess every component in the boundary; sample only where appropriate

The assessor assesses all components inside the assessment boundary and uses sampling only where it is appropriate to reach a determination of control effectiveness. Because IRAP assessments focus on systems and services rather than whole environments, most controls are assessed directly for every in-scope component; sampling supports direct assessment (for example the historical application of patching, or a set of servers enrolled in a central deployment mechanism) and never serves to leave out components that need individual evaluation. Sample size follows the scale of the system, and where an adequate sample cannot be achieved the constraint and its impact are stated in the report.