IRAP is Australia’s Infosec Registered Assessors Program. It is a framework of independent assessors who review cloud and ICT services against Australian Government security guidance, especially the Information Security Manual (ISM). An IRAP assessment does not certify that a service is “secure forever”; it evaluates the current control design, implementation, and evidence within a defined scope.
IRAP matters because government buyers often need proof before placing sensitive workloads in a cloud or managed service. The assessment helps agencies understand which controls are inherited from the provider and which remain their responsibility, such as identity, logging, configuration, and data handling. In practice, defenders use IRAP reports to support risk decisions and authorisation, while attackers exploit the gaps that appear when teams assume a platform is compliant without checking the exact scope. For regulated environments, IRAP is a key assurance tool, not a replacement for local security governance.