IRAP Readiness for Web Applications & Cloud, Australia

Nano Solutions gets web applications and the cloud environments under them ready for an IRAP assessment: ISM-aligned architecture, the controls implemented, and the evidence assembled. We are not an assessor, and we say so on this page rather than in the fine print. Fremantle-based, WA Government CUAICTS2021 ICT panel supplier (Contractor #225).

What we cover, and what we don't

We build and operate web applications and the cloud infrastructure they run on. That is the layer we can take responsibility for, so it is the only layer we offer here.

We cover:

• The web application itself — identity and access, session handling, encryption in transit and at rest, logging, secure development practice.
• The cloud environment it runs in — segmentation, hardening, patching, backup and restore, administrative access.
• ISM control selection and the documentation and evidence an assessor will ask for.
• Remediating what an assessment finds, on the systems we can reach.

We do not cover:

• The assessment itself. We are not an ASD-endorsed IRAP assessor. The assessment must be performed by one, and it should not be performed by whoever built the system.
• Gateway systems and ICT outsourced service provider assessments. Both must be assessed by an ASD-endorsed assessor and neither is our work.
• SECRET and above. Our experience is at OFFICIAL, OFFICIAL: Sensitive and PROTECTED.
• Physical security, personnel vetting and facilities. These fall inside an assessment boundary and we are not the people to advise on them.

If your problem is mostly one of the things in the second list, the honest answer is that you want somebody else, and we will say so on the first call.

What an IRAP assessment actually is

IRAP — the Infosec Registered Assessors Program, run by the Australian Signals Directorate — is the process under which an ASD-endorsed assessor evaluates a system's security controls against the Australian Government Information Security Manual (ISM). Cloud services, ICT outsourced service providers and gateway systems have to be assessed this way, and Commonwealth entities also procure assessor services for their own systems deployed to cloud.

Worth being precise about one thing, because it is widely misunderstood: an IRAP assessment is not a certification and not an accreditation. ASD does not accredit, certify, endorse or register systems under IRAP, and neither do assessors. The output is an independent assessment of a system's security posture against the ISM, which the responsible authority then uses to make its own risk decision. Any vendor telling you they will make your system "IRAP certified" is describing something that does not exist.

What "scope" means

An assessment covers a defined system boundary, not a company. That boundary includes the environments in play — production, pre-production, test and development — the classification of the data being handled, and the people, processes, technologies and facilities the system relies on. Which is why the answer to "how much of this is your part?" is usually "the application and its cloud environment, and not the rest".

How IRAP relates to the ISM and the Essential Eight

These three fit together: the ISM is the control catalogue; the Essential Eight is a prioritised baseline of mitigations within it; and IRAP is the assessment process that evaluates a system against the ISM. Getting your Essential Eight maturity and ISM alignment right is most of the readiness work, so that is where we start.

How we work

1. Gap analysis — assess the application and its environment against the relevant ISM controls and your target classification; produce a clear findings register.
2. Roadmap — a prioritised, costed remediation plan to reach assessment readiness.
3. Remediation (we do it) — implement the controls: identity and access, network segmentation, encryption, logging, hardening, backups.
4. Evidence & documentation — assemble the System Security Plan inputs and evidence an assessor expects for our part of the boundary.
5. Assessment support — work alongside your chosen ASD-endorsed IRAP assessor and remediate the findings that belong to us.

Who this is for

Australian government entities and their suppliers running web applications that handle government data, typically at OFFICIAL: Sensitive or PROTECTED. As a WA Government CUAICTS2021 panel supplier working with government agencies, this is core ground for us — with Australian-resident engineers and Australian data sovereignty throughout.

It fits best when we also built or now operate the system, because readiness work is mostly engineering rather than paperwork, and the team that can change the code is the team that can close the gaps.