Australian Government Information Security Registered Assessor Program (IRAP)

The Information Security Registered Assessor Program (IRAP) provides a comprehensive process for the independent assessment of a system's security against Australian government policies and guidelines. The IRAP goal is to maximize the security of Australian federal, state, and local government data by focusing on the information and communications technology infrastructure that stores, processes, and communicates it.

IRAP overview

The Information Security Registered Assessors Program (IRAP) is governed and administered by the ACSC. IRAP provides the framework to endorse individuals from the private and public sectors to provide cyber security assessment services to the Australian government. Endorsed IRAP assessors can provide an independent assessment of ICT security, suggest mitigations and highlight residual risks. IRAP provides a comprehensive process for the independent assessment of a system's security against Australian government policies and guidelines. The IRAP goal is to maximize the security of Australian federal, state, and local government data by focusing on the information and communications technology infrastructure that stores, processes, and communicates it.

  • In 2014, Azure was launched as the first IRAP-assessed cloud service in Australia, hosted from datacenters in Melbourne and Sydney. These two datacenters give Australian customers control over where their customer data is stored, while also providing enhanced data durability in the event of a disaster through backups at both locations.
  • In early 2015, Office 365 became the first cloud productivity service to complete this assessment.
  • In April 2015, the ASD announced the CCSL certification of both Azure and Office 365, and in November 2015, of Dynamics 365.
  • In June 2017, ASD announced the recertification of Microsoft Azure and Office 365 for a greatly expanded set of services.
  • In April 2018, the ACSC announced the certification of Azure and Office 365 at the PROTECTED classification. Microsoft is the first and only public cloud provider to achieve this level of certification
  • In September 2019, Microsoft's updated IRAP assessment scope expanded to include 113 services at the PROTECTED classification.

CCSL overview

The Certified Cloud Services List (CCSL) identifies cloud services that have successfully completed an IRAP assessment by the Australian Government, and have been awarded certification by the Australian Cyber Security Centre (ACSC). The certification recognizes the successful completion, review, and acceptance of a comprehensive assessment undertaken by an Information Security Registered Assessor, so all Australian Government agencies can use it. The CCSL can also be referenced by New Zealand Government organizations in conducting their risk assessments as the NZ ISM and Australian Government ISM are aligned.

Microsoft's Azure, Dynamics 365 CRM, and Office 365 continue to be included on the CCSL for both Unclassified: Dissemination Limiting Markers (DLM) (now OFFICIAL: Sensitive) and PROTECTED data based on the previous IRAP assessment and certification by the Australian Cyber Security Centre (ACSC).

Microsoft and IRAP

In September 2019 Microsoft completed its annual update to the IRAP security assessments of Azure, Office 365, and Dynamics 365 Customer Engagement. For 2019, the scope of the Azure assessment includes both Dynamics 365 Customer Engagement and Azure DevOps.

The assessment of Microsoft's services in Australia covers the four available Azure regions. For Government and critical infrastructure, we've deployed two regions designed specifically for your needs that are delivered from CDC Data Centres in Canberra; Australia Central and Australia Central 2. The differences between the Australian regions are covered in detail in the Azure IRAP Assessment report, which is available on the Australia-specific page of Microsoft Service Trust Portal.

For each assessment, Microsoft engaged an ACSC-accredited IRAP assessor who examined the security controls and processes used by Microsoft's IT operations team, physical datacenters, intrusion detection, cryptography, cross-domain and network security, access control, and information security risk management of in-scope services. The IRAP assessments found that the Microsoft system architecture is based on sound security principles, and that the applicable Australian Government Information Security Manual (ISM) controls are in place and fully effective within our assessed services.

The risk management framework used by the ISM draws from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-37 Rev. 2, 'Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy.' Within this risk management framework, the identification of risks and selection of security controls can be undertaken using a variety of risk management standards, such as International Organization for Standardization (ISO) 31000:2018, Risk management - Guidelines. Broadly, the risk management framework used by the ISM has six steps:

  • Define the system
  • Select security controls
  • Implement security controls
  • Assess security controls
  • Authorize the system
  • Monitor the system

As always, additional compensating controls can be implemented on a risk-managed basis by individual agencies prior to agency authorization and subsequent use of these cloud services.

The IRAP assessment of Microsoft's services helps provide assurance to public sector customers in government and their partners that Microsoft has appropriate and effective security controls in place for the processing, storage, and transmission of PROTECTED and below classified information. This includes the majority of government, healthcare, and education data in Australia.

Microsoft in-scope cloud services

Frequently asked questions

To whom does the IRAP apply?

IRAP applies to all Australian federal, state, and local government agencies that use cloud services. New Zealand government agencies require compliance with a standard very similar to the Australian Government ISM, so they may also use the IRAP assessments.

Can I use Microsoft's compliance in my organization's risk assessment and approval process?

Yes. If your organization requires or is seeking an approval to operate in line with the ISM, you can use the IRAP security assessments of Azure and Office 365 in your risk assessment. You are; however, responsible for engaging an assessor to evaluate your implementation as deployed on Microsoft's platforms, and for the controls and processes within your own organization.

Where do I start with my organization's own risk assessment and approval to operate?

Start with What is IRAP? and follow it with the information below:

Use Microsoft Compliance Manager to assess your risk

Microsoft Compliance Manager is a feature in the Microsoft 365 compliance center to help you understand your organization's compliance posture and take actions to help reduce risks. Compliance Manager offers a premium template for building an assessment for this regulation. Find the template in the assessment templates page in Compliance Manager. Learn how to build assessments in Compliance Manager.

Resources