IRAP Assessment & Readiness, Australia

Nano Solutions provides IRAP readiness and remediation for Australian government and their suppliers — we design ISM-aligned architecture, implement the controls, and prepare the evidence an IRAP assessor needs, then close the gaps. Fremantle-based, WA Government CUAICTS2021 ICT panel supplier (Contractor #225).

What is an IRAP assessment?

IRAP — the Infosec Registered Assessors Program, run by the Australian Signals Directorate — is the process under which an ASD-endorsed assessor evaluates a system's security controls against the Australian Government Information Security Manual (ISM). It's commonly required for systems that store or process government information, particularly at the OFFICIAL: Sensitive and PROTECTED classifications.

Importantly, the formal IRAP assessment is conducted by an ASD-endorsed IRAP assessor — not by the system owner or their delivery partner. What we do is get you ready for it: align the system to the ISM, implement and document the controls, and assemble the evidence, so the assessment is a confirmation rather than a list of surprises.

How IRAP relates to the ISM and the Essential Eight

These three fit together: the ISM is the control catalogue; the Essential Eight is a prioritised baseline of mitigations within it; and IRAP is the assessment process that evaluates a system against the ISM. Getting your Essential Eight maturity and ISM alignment right is most of the readiness work — so that's where we start.

How we work

1. Gap analysis — assess the system against the relevant ISM controls and your target classification; produce a clear findings register.
2. Roadmap — a prioritised, costed remediation plan to reach assessment readiness.
3. Remediation (we do it) — implement the controls: identity and access, network segmentation, encryption, logging, hardening, backups.
4. Evidence & documentation — assemble the System Security Plan inputs and evidence an IRAP assessor expects.
5. Assessment support — work alongside your chosen ASD-endorsed IRAP assessor and remediate any findings.

Who needs IRAP readiness

Australian government entities and their suppliers operating systems that handle government data. As a WA Government CUAICTS2021 panel supplier working with government agencies, this is core ground for us — with Australian-resident engineers and Australian data sovereignty throughout.