Independent security assessments to identify risk, strengthen resilience, and support Australian Government security requirements.
Ingenium Group provides independent IRAP assessments conducted by assessors endorsed under the Australian Signals Directorate’s Infosec Registered Assessors Program (IRAP).
Our assessors help organisations understand the security posture of their ICT systems by assessing relevant security controls, identifying vulnerabilities and gaps, and recommending practical mitigation measures to strengthen security and resilience.
Contact us about an IRAP assessment
Understand your ICT security posture
An IRAP assessment provides an independent evaluation of an organisation’s ICT environment against relevant Australian Government security requirements.
Ingenium’s IRAP assessors work with clients to establish an appropriate assessment scope and assess relevant controls against the Australian Government Information Security Manual (ISM) and Protective Security Policy Framework (PSPF).
Assessments can cover SECRET ICT environments and below, including cloud services, gateways, specialised government network connections, information systems, system documentation, and risk mitigation.
When you may need an IRAP assessment
An IRAP assessment may be appropriate when:
- You are bidding for Australian Government work and need to demonstrate your ICT security posture
- A government contract requires an IRAP assessment of your on-premise or cloud environment
- You need to understand whether relevant ISM security controls have been appropriately implemented
- You want an independent assessment of vulnerabilities within your ICT systems and infrastructure
- You need to determine whether security documentation accurately reflects your ICT environment
- You need a clearer understanding of security gaps and the actions required to address them
Without an independent assessment, organisations may be unaware of vulnerabilities, missing security controls, inadequate configurations, or discrepancies between system documentation and the actual environment.
What an Ingenium IRAP assessment covers
- System architecture: Before commencing the security assessment, the IRAP assessor develops an understanding of the target environment, including its architecture, design, physical implementation, and supporting system documentation.
This establishes the context required to properly scope and undertake the assessment. - Physical security: Where relevant to the assessment, Ingenium considers whether the required physical security certification is in place.
ICT equipment may need to operate within an appropriately certified physical security zone to satisfy relevant ISM security control requirements. - Security controls: Our assessor works closely with the client to determine which ICT systems, infrastructure, and security controls are within scope.
Relevant components are assessed against applicable ISM controls and the PSPF to determine whether controls have been properly implemented and are operating effectively.
The findings are documented in a security assessment report provided to the client and ASD. - Mitigation strategies: Where security controls have not been implemented or are not operating as effectively as intended, the assessor identifies the issue and recommends appropriate mitigation strategies.
This provides the organisation with a clearer understanding of its security vulnerabilities and practical actions that can be considered to strengthen its security posture.
What an IRAP assessment can help you achieve
An independent IRAP assessment can help your organisation:
- Identify vulnerabilities and security-control gaps
- Better understand the security posture of ICT systems and infrastructure
- Strengthen internal and external cyber security resilience
- Identify discrepancies between documented and actual system configurations
- Prioritise security improvements and mitigation activities
- Support Australian Government customer and contractual security requirements
- Build greater confidence in the effectiveness of implemented security controls
Independent assessment, not system accreditation
It is important to understand what an IRAP assessment does and does not provide.
Ingenium’s IRAP assessors independently assess systems and relevant security controls. They do not accredit, certify, endorse, or register systems on behalf of ASD.
The scope of each assessment is agreed with the client and may not include every ISM security control. Completion of an IRAP assessment therefore does not, by itself, mean that a system is compliant with every security control.
The assessment report identifies what has been assessed and provides the information needed to understand the findings, risks, and areas requiring attention.
How we work with you
Every ICT environment and assessment requirement is different, so Ingenium works with the client to establish an appropriate scope before assessment begins.
Our IRAP assessor develops an understanding of the environment and its supporting documentation, confirms the systems and infrastructure within scope, assesses the applicable security controls, documents the findings, and identifies appropriate mitigation strategies where issues are found.
The assessor works closely with client stakeholders throughout the engagement so they understand the assessment and its findings.
Ingenium can also provide ongoing cyber security consultancy to support subsequent security improvements and further assessments.
Experienced in complex and secure environments
Ingenium’s IRAP capability is supported by experience across Australian Government, Defence, and complex ICT environments.
Our cyber security capability includes ASD-endorsed IRAP assessors and personnel holding recognised certifications including CISSP, CISA, and CISM. We work with Australian Government security frameworks including the ISM, PSPF, and ASD Essential Eight.
Ingenium’s assessors have undertaken IRAP assessments for government organisations and government suppliers, including within highly complex ICT environments.
Why Ingenium
Ingenium combines specialist cyber security expertise with extensive experience operating within Australian Government and Defence environments.
Our capability includes ASD-endorsed IRAP assessors, DISP membership, senior security expertise, and practical experience assessing complex ICT environments.
Ingenium has more than five experienced IRAP assessors, more than a decade of IRAP experience, and more than 20 years of security experience across the ADF and Defence. All Ingenium IRAP assessors hold at least an NV1 security clearance.
This combination of assessment expertise, government security experience, and broader ICT capability allows us to understand both the security controls being assessed and the technical environments in which they operate.
Frequently asked questions
Talk to us about your IRAP assessment requirements
Whether you need an IRAP assessment for an on-premise or cloud environment, to support Australian Government requirements, or to better understand the security posture and resilience of your ICT systems, talk to Ingenium about your requirements.