[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Compliance and Regulations](/category/compliance-and-regulations) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What is the InfoSec Registered Assessors Program (IRAP)?](/blog/irap) Publish date July 11, 2025 {x} minute read # What is the InfoSec Registered Assessors Program (IRAP)? [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Nicholas Sollitto](/team/nicholas-sollitto) Senior Cybersecurity Writer Nicholas's cybersecurity writing has been featured in G2. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The Information Security Registered Assessors Program is a [cybersecurity](https://www.upguard.com/blog/cyber-security) initiative created by the Australian Cyber Security Centre (ACSC), a subsidiary of the Australian Signals Directorate (ASD). IRAP assessments utilize [cybersecurity standards](https://www.upguard.com/blog/regulation-vs-cyber-framework) set by the Australian Government Information Security Manual (ISM) and Australia’s Protective Security Policy Framework (PSPF). Until July 2020, the ASD’s Cloud Services List (CCSL) included all organizations that had achieved IRAP certification. The ACSC has since disbanded the CCSL and replaced it with the Cloud Security Guidance Package. This package provides support and a concrete cybersecurity framework IRAP assessors, prospective organizations, and [cloud service providers](https://www.upguard.com/blog/cspm) (CSPs) can use to conduct security assessments, appraise [security controls](https://www.upguard.com/blog/cis-controls), and establish robust protocols to prevent [cybersecurity incidents](https://www.upguard.com/blog/cyber-incident-reporting). Keep reading to learn more about IRAP security requirements and how IRAP compliance empowers organizations to achieve robust security standards and install fundamental protections to defend against [cyber threats](https://www.upguard.com/blog/cyber-threat). [Discover how UpGuard helps organizations improve their security posture>](https://www.upguard.com/product/breachsight) ## How to Achieve IRAP Certification Australia has passed widespread cybersecurity laws and regulations to combat cyber threats like hacking, fraud, and [data breaches](https://www.upguard.com/blog/cost-of-data-breach). Like other certification frameworks, IRAP requires accredited organizations to assess applicants’ [security posture](https://www.upguard.com/blog/security-posture) to award them an IRAP certificate. Independent IRAP assessors utilize two frameworks to maintain standard auditing procedures and evaluate an organization’s ability to protect their information and communications technology (ICT): * **The Information Security Manual (ISM):** Guidelines focused on assisting organizations with internal security controls and employing [comprehensive risk assessments](https://www.upguard.com/product/risk-assessments) to improve [risk analysis](https://www.upguard.com/blog/how-to-perform-a-cyber-risk-analysis) * **The Protective Security Policy Framework (PSPF):** Regulations that ensure Australian government agencies achieve and maintain [industry security standards](https://www.upguard.com/blog/cybersecurity-regulations-financial-industry) To earn IRAP certification, applying organizations must meet the following baseline qualifications: * Possess Australian citizenship * Maintain ethical cybersecurity practices * Obtain secret-level clearance by meeting the requirements of a protected-level assessment * Demonstrate qualifications with one framework from Category A * Demonstrate qualifications with one framework from Category B ### IRAP Certification Framework Categories To appraise the security standards of an organization, IRAP assessors utilize two categories of [common cybersecurity frameworks](https://www.upguard.com/blog/top-cybersecurity-frameworks-finance). Organizations must meet the requirements of at least one framework from each category to achieve certification. #### Category A * Certified Information Systems Security Professional (CISSP) * Certified Information Security Manager (CISM) * GIAC Security Leader Certification (GSLC) #### Category B * Certified Information Systems Auditor (CISA) * [Payment Card Industry](https://www.upguard.com/blog/pci-compliance) Qualified Security Assessor (PCI QSA) * [ISO 27001](https://www.upguard.com/blog/what-is-iso-27001) Lead Auditor * GIAC Systems and Network Auditor (GSNA) * Certified in Risk and Information Systems Control (CRISC) ### Who Does IRAP Apply To? IRAP accreditation is a requirement for all Australian government agencies that rely on cloud services, including federal, state, and local agencies. Public sector organizations who want to work alongside the Australian government must also achieve IRAP certification to demonstrate exceptional risk management protocols before pursuing government contracts. ## What is the Information Security Manual (ISM)? The ACSC created the ISM to guide executive personnel, mainly CISOs and CIOs, through cybersecurity processes and information security developments. Organizations are only directly required to comply with the ISM if they work with the government or another organization that requires compliance. The ISM provides guidelines similar to the National Institute of Standards and Technology (NIST) in the United States. The ISM provides guidelines for the following areas of security: * [Personnel roles and clearances](https://www.upguard.com/blog/rbac) * [Incident response](https://www.upguard.com/blog/incident-response-plan) * [Cyber Vendor Risk Management](https://www.upguard.com/blog/what-is-cyber-vendor-risk-management) * Documentation * [Physical security](https://www.upguard.com/blog/working-from-home-security-tips) * Personnel security * System management * [Cryptography](https://www.upguard.com/blog/cryptography) * Communications infrastructure ## What is the Protective Security Policy Framework (PSPF)? The PSPF helps Australian Government entities “protect their people, information, and assets, both at home and overseas.” The Digital Transformation Agency (DTA) utilizes the PSPF to appraise whether a third-party organization prioritizes high-quality security and should be considered a candidate for government contracts or other partnerships. The policy employs 16 core requirements to ensure an organization has installed security controls that protect all government personnel, data, and digital assets. The PSPF focuses on implementing standards across the following security areas: * [Security governance](https://www.upguard.com/blog/cyber-risk-governance) * [Information security](https://www.upguard.com/blog/information-security) * Personnel security * Physical security > A high-quality standard of third-party cybersecurity is influenced by focused data breach prevention initiatives such as [Third-Party Risk Management](https://www.upguard.com/blog/third-party-risk-management). ## How to Apply For IRAP Certification Applying for IRAP certification can be confusing if an organization is unaware of all the critical steps in the process. Overall, applying for IRAP certification includes five primary steps: 1. Select an IRAP assessor 2. Undergo a security audit 3. Receive a security assessment report 4. Install corrections and recommendations 5. Apply for certification ### Step 1: Select an IRAP Assessor The first step in the IRAP application process is to choose an IRAP assessor. Before selecting an assessor and moving forward with the certification process, organizations should ensure their choice is accredited and registered with the ASD. ### Step 2: Undergo a Security Audit After selecting an IRAP assessor, the applying organization will need to undergo a security assessment. The certification agency will use this assessment to appraise an organization’s information systems and its ability to defend against common [security risks](https://www.upguard.com/blog/evaluating-managing-service-provider-security-risks). This assessment may include interviews with IT personnel, risk assessment [audits](https://www.upguard.com/blog/how-to-perform-a-cybersecurity-audit), and subsequent evaluations to determine how well an organization protects [sensitive data](https://www.upguard.com/blog/protecting-sensitive-data), [data centers](https://www.upguard.com/glossary/security-operations-center), and other critical data and infrastructure. ### Step 3: Receive a Security Assessment Report After completing their assessment, the IRAP assessor will demonstrate their findings to the applicant. The assessor will likely provide a security gap analysis and a risk assessment report. These reports highlight critical weaknesses, known vulnerabilities, and other real-time flaws in an organization’s cybersecurity program. ### Step 4: Install Corrections and Recommendations Once the IRAP assessor has provided their findings, it’s up to the organization to install necessary corrections and recommendations. Organizations that implement all the required changes and correct weaknesses in their security will be better suited to achieve certification. ### Step 5: Apply for Certification After implementing all necessary corrections, an organization can formally apply for IRAP certification. The assessor will then conduct a final risk assessment to certify that the organization’s IT systems and cybersecurity program meet all IRAP requirements. ### How Long Does IRAP Certification Take? The exact timeline for IRAP certification will depend on the size and complexity of an organization and the current health of the organization’s security posture. Overall, IRAP certification can take a few months to over a few years. Organizations that already maintain excellent [cyber hygiene](https://www.upguard.com/blog/cyber-hygiene) will have an easier time achieving certification than those that need to install extensive corrections to patch weaknesses. ## What are the Benefits of IRAP Certification? IRAP certification offers organizations a host of benefits. IRAP certification is generally revered for its robust information security standards and ability to demonstrate effective hygiene throughout the entire cybersecurity lifecycle. Here are some of the main benefits associated with IRAP certification: * Increased industry credibility * Regulatory compliance * Improved risk management * Improved security posture * Competitive advantage ### Increased Industry Credibility IRAP is a trusted standard for cybersecurity, and many industries recognize IRAP-certified organizations as leaders in information security. Organizations that achieve certification will have an easier time demonstrating their cyber hygiene to prospective partnerships and when applying for government contracts. ### Regulatory Compliance Organizations that install IRAP regulations will be better suited to comply with industry regulations and standards. Once an organization achieves IRAP certification, it may also be able to apply for other certificates with little to no effort, further improving its reputation and scope. ### Improved Risk Management IRAP accreditation is more than just a certificate. The framework also directly improves the risk management policies of certified organizations by installing more rigid security controls and providing organizations with guidelines to optimize their cybersecurity programs. ### Improved Security Posture Just as IRAP helps organizations improve risk management protocols, certification also improves security posture. The IRAP certification process will identify weaknesses and vulnerabilities within an organization’s information security infrastructure. ### Competitive Advantage IRAP-certified organizations will be competitive when bidding on contracts that demand applicants to demonstrate high-level cybersecurity or information security. Certification can also help organizations maintain a healthy reputation with customers and existing industry partners. IRAP accreditation is also a requirement for any organization that wants to work alongside the Australian government. By achieving certification, organizations will access a wider pool of leads, including government contracts. ## How Can UpGuard Help With IRAP Certification? [UpGuard](https://www.upguard.com/) is an all-in-one cybersecurity solution that can help organizations achieve IRAP certification by identifying security posture weaknesses across their internal systems and external supply chains. [UpGuard Breach Risk](https://www.upguard.com/product/breachsight) is a leading attack surface management solution that enables users to streamline their risk management processes and better position themselves to comply with regulatory frameworks and certifications. [Breach Risk's](https://www.upguard.com/product/breachsight) powerful toolbox of cybersecurity features helps users with: * Continuous monitoring * [Regulatory compliance](https://www.upguard.com/blog/what-is-compliance-management)[‍](https://www.upguard.com/product/data-leak-detection) * [Data leak detection](https://www.upguard.com/product/breach-risk/threat-monitoring)[‍](https://www.upguard.com/blog/attack-surface-reduction-examples) * [Attack surface reduction](https://www.upguard.com/blog/attack-surface-reduction-examples)‍ * Risk remediation workflows[‍](https://help.upguard.com/en/articles/3883003-how-to-use-risk-waivers-in-upguard) * [Risk waivers](https://help.upguard.com/en/articles/3883003-how-to-use-risk-waivers-in-upguard)[‍](https://www.upguard.com/product/reporting) * [Stakeholder reporting](https://www.upguard.com/product/reporting)[‍](https://www.upguard.com/integrations) * [Third-party integrations](https://www.upguard.com/integrations) UpGuard has helped organizations of all sizes and industries, including healthcare, financial services, technology, and more. eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Compliance and Regulations #### [Cyber Resilience Act Preparedness: Who's Ready, and Who Can't Be Reached](/blog/cyber-resilience-act-preparedness-whos-ready-and-who-cant-be-reached) We surveyed 2,374 EU-registered devices and 226 listed software makers for a way to report a vulnerability. Market leaders are ready. Others, not so much. [](/team/greg-pollock) [Greg Pollock](#) October 13, 2026 Human Cyber Risk #### [AI Assurance: The Third Head of Your AI Governance Watchdog](/blog/ai-governance-to-ai-assurance) AI governance needs three things: policy, enforcement, and assurance. Most organizations have built the first two. Here's why the third one matters now. [](/team/shane-moosa) [Shane Moosa](#) October 29, 2026 Compliance and Regulations #### [NIST compliance in 2026: A complete implementation guide](/blog/nist-compliance) NIST compliance ensures alignment with leading cybersecurity frameworks. Explore how the NIST standards can safeguard sensitive data and manage third-party [](/team/edward-kost) [Edward Kost](#) January 5, 2026 Compliance and Regulations #### [Introducing UpGuard’s DPDP Act Security Questionnaire](/blog/upguards-dpdp-security-questionnaire) Discover the latest addition to UpGuard's industry-leading Questionnaire Library and learn how to achieve comprehensive DPDP compliance. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) November 19, 2024 Compliance and Regulations #### [From NIS to NIS2: What Your Organization Needs to Know](/blog/nis-vs-nis2) Understanding the transition from NIS to NIS2 is crucial for protecting your organization. Explore the key changes and compliance steps in this blog. [](/team/leah-sadoian) [Leah Sadoian](#) July 4, 2025 Compliance and Regulations #### [How to Prepare for a Cyber Essentials Plus Audit](/blog/prepare-for-a-cyber-essentials-plus-audit) Learn more about the Cyber Essentials Plus independent assessment process, and steps your organization can take to prepare. [](/team/leah-sadoian) [Leah Sadoian](#) July 3, 2025 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)