Australia IRAP - Information Security Registered Assessors Program
The Australian Signals Directorate's requirements for IRAP assessments: the 46 IRAP Assessment Requirements of the IRAP Common Assessment Framework, grouped under the seven quality standards ASD appraises reports against (report quality and terminology, assessment process and frameworks, evidence gathering, coverage, objectivity, technical accuracy and completeness, assessment integrity), and the assessment-conduct duties of IRAP Policy and Procedures (June 2026). IRAP assessments of cloud services, outsourced ICT and gateways are mandatory under the PSPF; the requirements bind the endorsed assessor who performs them.
Australia IRAP - Information Security Registered Assessors Program is a compliance framework from Australia (Australian Signals Directorate) with 8 domains and 54 controls that map to 3 other frameworks. The largest domains are Quality standard: Report quality and terminology – Australia IRAP - Information Security Registered Assessors Program (10 controls), Quality standard: Technical accuracy and completeness – Australia IRAP - Information Security Registered Assessors Program (10 controls), IRAP Policy and Procedures: assessment-conduct duties – Australia IRAP - Information Security Registered Assessors Program (8 controls). Every control below carries what it requires and what an assessor expects to see.
Get the official standard. This page is a source-grounded companion to the published text, not a replacement for it.
Visit cyber.gov.auFramework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
IRAP Policy and Procedures: assessment-conduct duties – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::PP-3.5.6(a)(iii) | PP-3.5.6(a)(iii) Accept no terms that block ASD quality assurance |
| australia-irap-information-security-registered-assessors-program::PP-3.5.6(a)(iv) | PP-3.5.6(a)(iv) Secure assessment information and devices |
| australia-irap-information-security-registered-assessors-program::PP-3.5.6(a)(v) | PP-3.5.6(a)(v) Provide the report to ASD on request and close the record |
| australia-irap-information-security-registered-assessors-program::PP-3.5.6(a)(vi) | PP-3.5.6(a)(vi) Take part in quality assurance and complete corrective actions |
| australia-irap-information-security-registered-assessors-program::PP-3.5.6(a)(vii) | PP-3.5.6(a)(vii) Follow brand and marketing guidelines |
| australia-irap-information-security-registered-assessors-program::PP-4.1.4 | PP-4.1.4 Every assessor on an engagement records, signs off and answers for it |
| australia-irap-information-security-registered-assessors-program::PP-4.3.3 | PP-4.3.3 Handle personal information under the Privacy Act 1988 |
| australia-irap-information-security-registered-assessors-program::PP-4.4.11 | PP-4.4.11 Stop or do not start where a conflict is not mitigated |
Quality standard: Assessment integrity – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0008 | IRAP-AR-0008 Submit a conflict of interest declaration before starting |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0009 | IRAP-AR-0009 Lodge the declaration at least 7 business days ahead |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0010 | IRAP-AR-0010 Keep the declaration current and tell ASD of changes |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0011 | IRAP-AR-0011 Disclose the nature of conflicts in the report |
Quality standard: Assessment process and frameworks – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0012 | IRAP-AR-0012 Apply the relevant Australian Government frameworks |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0013 | IRAP-AR-0013 Record the activities of each assessment stage |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0014 | IRAP-AR-0014 Use the latest ISM release |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0015 | IRAP-AR-0015 Delta-assess when two ISM releases lapse |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0022 | IRAP-AR-0022 Follow the Common Assessment Framework |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0039 | IRAP-AR-0039 Describe the entity's risk management processes |
Quality standard: Coverage – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0017 | IRAP-AR-0017 Review, validate and maintain the assessment boundary |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0018 | IRAP-AR-0018 Define the assessment boundary in the report |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0019 | IRAP-AR-0019 Cover data sovereignty and offshore elements |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0020 | IRAP-AR-0020 Cover every environment and device in the boundary |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0021 | IRAP-AR-0021 Justify what is out of scope |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0029 | IRAP-AR-0029 Understand the previous report and carry forward relevant findings |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0031 | IRAP-AR-0031 Assess each service separately and flag deviations |
Quality standard: Evidence gathering – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0001 | IRAP-AR-0001 Assess every component in the boundary; sample only where appropriate |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0002 | IRAP-AR-0002 Explain the sampling methodology |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0005 | IRAP-AR-0005 Gather evidence of sufficient quality for the system and control |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0026 | IRAP-AR-0026 Record the evidence behind each control |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0027 | IRAP-AR-0027 Document insufficient evidence and mark the controls |
Quality standard: Objectivity – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0004 | IRAP-AR-0004 Base findings on presented evidence, not assumption |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0040 | IRAP-AR-0040 Explain why each control is effective or ineffective |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0041 | IRAP-AR-0041 No statements of compliance, certification or authorisation |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0042 | IRAP-AR-0042 No biased or misleading statements or marketing |
Quality standard: Report quality and terminology – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0003 | IRAP-AR-0003 Use ASD's control-effectiveness terminology |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0006 | IRAP-AR-0006 State constraints and limitations and their impact |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0007 | IRAP-AR-0007 Gather, evaluate and include consumer recommendations |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0023 | IRAP-AR-0023 Assess what is implemented, not what is planned |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0032 | IRAP-AR-0032 Have the report reviewed before release |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0033 | IRAP-AR-0033 Describe impact, never rate risk |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0034 | IRAP-AR-0034 Surface key weaknesses early in the report |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0044 | IRAP-AR-0044 Set out the shared responsibility model |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0045 | IRAP-AR-0045 Use ASD's report and controls matrix templates |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0046 | IRAP-AR-0046 Deliver the complete report and controls matrix |
Quality standard: Technical accuracy and completeness – Australia IRAP - Information Security Registered Assessors Program
| Code | Title |
|---|---|
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0016 | IRAP-AR-0016 Be supported by a skilled team where expertise is lacking |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0024 | IRAP-AR-0024 Record assessment objects and methods per control |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0025 | IRAP-AR-0025 Show sound technical understanding in the report |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0028 | IRAP-AR-0028 Explain each technology's function and purpose |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0030 | IRAP-AR-0030 Alternate controls must meet the ISM control's intent |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0035 | IRAP-AR-0035 Set out the system's vulnerabilities and weaknesses |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0036 | IRAP-AR-0036 Write for the intended audience |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0037 | IRAP-AR-0037 Explain technical aspects clearly |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0038 | IRAP-AR-0038 Explain architecture, design and control implementation |
| australia-irap-information-security-registered-assessors-program::IRAP-AR-0043 | IRAP-AR-0043 Detail deviations from technical guidance |
Your Compliance Coverage
If you comply with Australia IRAP - Information Security Registered Assessors Program, you already cover:
Maps to 3 other frameworks
Coverage is not the same as your position
This page shows what Australia IRAP - Information Security Registered Assessors Program overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Australia IRAP - Information Security Registered Assessors Program and who does it apply to?
Australia IRAP - Information Security Registered Assessors Program is a compliance framework from Australia (Australian Signals Directorate) with 8 domains and 54 controls. The Australian Signals Directorate's requirements for IRAP assessments: the 46 IRAP Assessment Requirements of the IRAP Common Assessment Framework, grouped under the seven quality standards ASD appraises reports against (report quality and terminology, assessment process and frameworks, evidence gathering, coverage, objectivity, technical accuracy and completeness, assessment integrity), and the assessment-conduct duties of IRAP Policy and Procedures (June 2026). IRAP assessments of cloud services, outsourced ICT and gateways are mandatory under the PSPF; the requirements bind the endorsed assessor who performs them. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Australia IRAP - Information Security Registered Assessors Program actually require?
Australia IRAP - Information Security Registered Assessors Program has 54 controls organised across 8 domains. The largest domains are Quality standard: Report quality and terminology – Australia IRAP - Information Security Registered Assessors Program (10 controls), Quality standard: Technical accuracy and completeness – Australia IRAP - Information Security Registered Assessors Program (10 controls), IRAP Policy and Procedures: assessment-conduct duties – Australia IRAP - Information Security Registered Assessors Program (8 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Australia IRAP - Information Security Registered Assessors Program do I already cover?
Australia IRAP - Information Security Registered Assessors Program maps to 3 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (20% coverage), Australian Information Security Manual (7% coverage), NIST Cybersecurity Framework 2.0 (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Australia IRAP - Information Security Registered Assessors Program?
Start your Australia IRAP - Information Security Registered Assessors Program compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Australia IRAP - Information Security Registered Assessors Program requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 54 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required