IRAP and the Essential Eight for selling IT to Australian government

Selling cloud services or managed IT to Australian government agencies means understanding two things from the Australian Signals Directorate (ASD): IRAP and the Essential Eight.

IRAP

The Infosec Registered Assessors Program (IRAP) endorses assessors who check whether a system or cloud service meets the controls in the Australian Government Information Security Manual (ISM). An IRAP assessment produces a report that agencies use to decide whether to use the service.

IRAP assessments are commonly expected for:

• Cloud services handling government data, especially at the PROTECTED level.
• Managed services with access to agency systems.
• Hosting and data centre providers, alongside the government's Hosting Certification Framework.

You hire an IRAP assessor directly, and the assessment's depth depends on the classification level and scope.

The Essential Eight

The Essential Eight is ASD's set of baseline strategies to mitigate cyber threats:

1. Patch applications.
2. Patch operating systems.
3. Multi-factor authentication.
4. Restrict administrative privileges.
5. Application control.
6. Restrict Microsoft Office macros.
7. User application hardening.
8. Regular backups.

Each has maturity levels from zero to three. Agencies are required to work toward set maturity levels, and many now ask suppliers about their own Essential Eight maturity in tenders and security questionnaires.

How small firms can prepare

• Start with the Essential Eight for your own business. It's practical, well documented by ASD, and reduces real risk.
• Build on IRAP-assessed platforms. Major cloud providers have IRAP assessments that you can reference for the infrastructure layer.
• Get an IRAP assessment for your own service when you're targeting agencies that need it.
• List on BuyICT, where agencies look for cloud services and digital specialists.

See selling IT to government in Australia.

Common questions

Is IRAP mandatory for Australian government cloud contracts?

It isn't a single legal requirement for every purchase, but many agencies expect an IRAP assessment for cloud services handling government data, especially at PROTECTED level.

What is Essential Eight maturity level two?

It's the middle maturity level, designed to mitigate adversaries who put in more effort than opportunistic attackers. Many agencies target it as a baseline.

Can a New Zealand or Canadian firm get an IRAP assessment?

Yes. IRAP assessments assess the system, not the nationality of the firm, though some agencies have additional requirements about data location and staff.