Why IRAP Assessment Matters When Choosing a Technology Provider

Cyber security has become an increasingly important consideration when organisations select the technology platforms they rely on.

For government agencies, critical infrastructure operators, large enterprises and organisations handling sensitive information, it is no longer enough for a software provider simply to say that security is important. Customers increasingly want evidence.

Independent security assessments provide one way for organisations to gain greater confidence in the systems and providers they are considering. In Australia, the Infosec Registered Assessors Program — better known as IRAP — has become an important part of that assurance landscape.

And for technology providers prepared to undertake an IRAP assessment, the process represents a significant commitment to having their security environment independently examined.

What does it mean to be IRAP assessed?

IRAP is an Australian Signals Directorate initiative that provides a framework for independent assessment of systems against Australian Government security requirements.

Assessments are performed by ASD-endorsed IRAP assessors who examine the security controls implemented within the defined assessment scope.

Importantly, IRAP is an assessment rather than a certification. The value lies in the independent examination itself: reviewing controls, examining supporting evidence, identifying security risks and documenting opportunities for improvement.

For customers assessing a technology provider, this offers something that internal policies and security statements alone cannot provide — independent scrutiny of the provider's security environment.

Independent assessment carries greater weight

Most technology providers today have security policies.

Many will also state that they use encryption, control access to systems, monitor vulnerabilities, maintain backups and have incident response procedures.

These measures are important, but there is an obvious difference between a provider describing its own security controls and having those controls examined independently. An IRAP assessment requires the provider to support its security claims with evidence.

Depending on the scope of the assessment, this can involve detailed examination of areas such as:

• identity and access management;

• infrastructure and system security;

• vulnerability and patch management;

• logging and monitoring;

• incident response;

• backup and recovery;

• change management;

• security governance; and

• protection of information.

That additional level of scrutiny can give customers greater confidence that security controls have been considered in a structured and demonstrable way.

IRAP requires a significant investment from the provider

An IRAP assessment is not a simple questionnaire or checklist.

Preparing for and completing an assessment can require considerable involvement from security, technical, operational and management teams.

Documentation needs to be prepared and reviewed. Evidence must be collected. Systems and processes need to be examined. Technical questions need to be addressed. Findings need to be understood and, where appropriate, remediation activities planned.

This requires time, specialist expertise and financial investment.

For organisations comparing technology providers, that commitment is worth recognising.

A provider that has invested in independent security assessment has gone beyond simply stating that it follows good security practices. It has been prepared to open its environment to external scrutiny and demonstrate how its controls operate.

Assessment creates stronger security environments

One of the most valuable outcomes of an independent security assessment is not simply confirming what an organisation is already doing well.

It is identifying where things can be improved.

A detailed assessment may identify opportunities to strengthen technical controls, documentation, governance, processes or supporting evidence.

This provides organisations with a structured basis for prioritising security improvements.

Rather than viewing findings negatively, mature security organisations use them to strengthen their overall security posture.

The assessment therefore becomes part of a broader cycle:

Implement controls → independently assess them → identify improvements → remediate → continue monitoring and improving.

That process can provide considerable long-term value to both the technology provider and its customers.

Why IRAP assessment should influence technology procurement

When organisations compare software providers, many products can appear similar from a functional perspective.

Security assurance can therefore become an important differentiator.

An organisation that has completed an IRAP assessment has committed resources to having its security controls independently examined against recognised Australian Government security guidance.

For government agencies and organisations with demanding cyber security requirements, this can provide valuable additional assurance during procurement and supplier due diligence.

It can also help procurement and security teams distinguish between providers relying primarily on self-declared security practices and those that have invested in external assessment.

IRAP status should therefore be a meaningful consideration when organisations assess the security maturity and suitability of potential technology partners.

The investment behind security assurance

Strong cyber security rarely comes from a single technology or policy. It requires sustained investment across people, processes, infrastructure, governance, testing and external assurance. Undertaking an IRAP assessment is one example of that investment.

The process requires organisations to examine their own security practices closely, demonstrate those practices to an independent assessor and respond constructively to areas where further improvement may be possible.

For customers, this commitment can be an important indication of how seriously a provider approaches security. It demonstrates a willingness to invest in assurance rather than asking customers simply to accept security claims at face value.

myosh has now completed its IRAP assessment

When we first wrote about why IRAP matters to Australian businesses, myosh was progressing through its own IRAP assessment.

That assessment has now been completed.

myosh has undergone an independent IRAP assessment of its environment, further strengthening the security assurance supporting the myosh platform.

The assessment provided an opportunity to independently examine our security controls, supporting evidence and processes, while identifying further opportunities for continuous improvement.

For organisations considering myosh — particularly those operating within government, critical infrastructure and other security-conscious industries — completing the assessment provides another level of independent security assurance.

It is also part of a broader commitment to continually reviewing and strengthening the security practices supporting the myosh platform.

Security assurance is becoming increasingly important

Technology providers are being asked more detailed security questions than ever before.

Customers want to understand where their information is hosted, how access is controlled, how vulnerabilities are managed, how incidents are handled and how providers verify that security controls remain effective.

Independent assessments such as IRAP help provide evidence behind those answers.

For organisations selecting software platforms, providers that have committed the time, resources and expertise required to complete an independent security assessment deserve serious consideration.

Ultimately, IRAP assessment is about more than completing a security exercise.

It demonstrates a willingness to be independently examined, to provide evidence and to continually strengthen the systems customers rely on.

And as cyber security becomes an increasingly important part of technology procurement, that commitment is likely to matter more than ever.

‍