Infosec Registered Assessors Program
Voluntary. IRAP is an assessment program, not legislation. A private law firm is not required to hold an assessment of its own network unless a contract or a lawful direction requires it.
ASD’s program of endorsed assessors who independently assess a system. An IRAP assessment is not a certification, and it does not authorise the system for use.
MaintainedLast reviewed
Key facts
- Issued by
- Australian Signals Directorate
- Sources listed
- 2
This is a reading aid for an Australian law firm. It is not legal advice, not a certification, and not a finding that a tool or a firm complies. The sentences paraphrase the sources listed, checked on the date shown. Where a standard is sold by ISO or the AICPA, the page uses the publisher’s public description and does not reproduce the standard.
What it is
The Infosec Registered Assessors Program gives Australian Government entities and organisations, including small and medium businesses, access to cyber security professionals who conduct independent security assessments. ASD says an assessment can show a system’s strengths and weaknesses and can recommend mitigations.
ASD says assessors can assess systems and services handling information classified SECRET and below, including ICT systems, gateways and GovLINK. ASD endorses individuals, from the private and public sectors, to provide those services. The Common Assessment Framework says an assessment uses the Australian Government frameworks relevant to that system, including the Information Security Manual and, where it applies, the Protective Security Policy Framework. Those are inputs to an assessment. ASD’s IRAP page also says assessors help entities meet their requirements set by the Protective Security Policy Framework, so an assessment can inform a government entity’s PSPF obligations. It still does not authorise the system for use.
Who it applies to
The program is aimed at Australian Government entities and major organisations that want an independent assessment. A private law firm is not required to hold an IRAP assessment of its own network. A firm buying a cloud service that will hold government information, or that advertises “IRAP”, is a reader of someone else’s assessment, not the body that endorses it.
What it asks of a law firm using AI
- ASD’s IRAP page says assessors do not accredit, endorse or register systems on ASD’s behalf. An assessment will generally not cover every control in the Information Security Manual. Completion of an assessment does not mean the system is compliant with the controls that were tested.
- The IRAP Common Assessment Framework says assessors do not accredit, certify, endorse or register systems on behalf of ASD, the assessed entity, or the consuming agency. The assessor reports strengths and weaknesses. The authorising officer decides whether to authorise the system.
- The framework says the minimum deliverables are an IRAP security assessment report, or a cloud security assessment report, and a controls matrix or cloud controls matrix.
- A vendor line that says “IRAP assessed” is a claim about a point-in-time assessment of a named system. Ask for the report, the system boundary, the classification, the ISM edition, and the date. A consumer plan, or a feature added later, may sit outside that boundary.
How it maps to this framework
The rows are this site’s questions. Where the cell says “Not set here”, the instrument does not set that requirement. The gap is still recorded, so it is not treated as answered.
| This site’s question | What the instrument says that bears on it |
|---|---|
| Efficiency Whether the tool saves total human work at the quality the task needs. | Not set here. |
| Effectiveness Whether the output is good enough for the task. The catalogue does not score this. | Not set here. |
| Due diligence What the firm has actually read about hosting, training and assurance before it relies on the tool. | IRAP is a due-diligence artefact. The useful questions are which system, which classification, which date, and whether the firm’s configuration is the one that was assessed. The report is evidence for the firm to read. It is not a pass mark. |
| Confidentiality Whether client and other confidential information can go into the tool. | An assessment can describe controls that protect classified or official information on that system. It does not say a solicitor may place a client’s confidential documents into the service. |
| Disclosure When the firm tells the client, and where required the court or another party, that AI was used. | Not set here. |
| Certifications ISO, SOC 2 and IRAP names recorded against the tool. A listed name is not a finding that the certificate covers the firm’s plan. | IRAP is the assurance name this framework records alongside ISO 27001 and SOC 2. Record it as listed only when the catalogue, or a document the firm has seen, says an assessment exists. Listed is not a finding that the certificate covers the plan, because IRAP does not issue a certificate at all. |
| Data residency Where the tool holds data, including whether that place is recorded as Australia. | Government assessments are often concerned with where official information is stored and who can see it. The IRAP page checked here does not publish a rule that every assessed service stores data in Australia. Read the report for the system you are buying. |
Sources
Checked 2026-10-10. Issued by Australian Signals Directorate.