Australian Information Security Manual
Guidelines for procurement and outsourcing

Australian Information Security Manual ISM-1570: IRAP assessment of cloud providers

Outsourced cloud service providers and their non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET cloud services undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 6 controls across 5 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

New Zealand Information Security Manual (NZISM) · 2 controls

  • 22.1.20.C.02 22.1.20.C.02 Cloud providers apply NZISM controls to classified agency systems
  • 22.1.20.C.05 22.1.20.C.05 Formal provider assurance of NZISM control application

CIS Controls v8 · 1 control

ISO 27002:2022 · 1 control

  • 5.22 Monitoring, review and change management of supplier services

NIST Cybersecurity Framework 2.0 · 1 control

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • 0109 0109 Use cloud providers with an IRAP assessment in the last 24 months

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Guidelines for procurement and outsourcing

Query this from an agent

The graph holds this control, the 6 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Australian Information Security Manual controls