Independent security assessments for government and industry.

Assurance Bureau delivers Information Security Registered Assessors Program (IRAP) assessments for organisations seeking to host, process, or transmit Australian Government data. Our assessments are conducted by ASD-endorsed IRAP Assessors holding an active NV1 security clearance, with direct experience across government-adjacent environments.

What is an IRAP Assessment?

IRAP is an Australian Signals Directorate (ASD) initiative that provides a framework for assessing the security of systems and services against the Australian Government Information Security Manual (ISM). The ISM derives its authority from the Protective Security Policy Framework (PSPF), which requires Commonwealth entities to apply security controls using a risk-based approach.

IRAP assessments are required or expected for:

• Cloud service providers seeking to host or process Australian Government data

• Organisations tendering for government contracts involving sensitive data

• Agencies and their suppliers needing independent assurance of security controls

What we assess

• Cloud and on-premise systems handling government data

• ISM control applicability and implementation

• Security documentation including the System Security Plan (SSP) and Incident Response Plan

• Control gaps and weaknesses documented in a Security Assessment Report (SAR) to inform your authorisation decision

Important to understand

IRAP assessors independently assess and report. We do not accredit, certify, or register systems on behalf of ASD, and a completed assessment does not constitute a declaration of compliance. The SAR is an input to your organisation's risk-based authorisation decision, which remains the responsibility of your system owner or authorising official.

Why Assurance Bureau

• ASD-endorsed IRAP Assessor

• Active Australian Government NV1 security clearance

• Experience across government, healthcare, and regulated industry environments

• Assessments are practical and outcome-focused, not checkbox exercises

Get in touch

Ready to discuss your IRAP assessment requirements? Contact us to arrange a no-obligation scoping conversation.