IRAP: Engineering Practice, Not Just Audit
The Information Security Registered Assessors Program (IRAP) is Australia's framework for assessing the security of systems handling government information. Most organisations approach IRAP assessment as a compliance event โ a point-in-time review that happens before go-live.
This is the wrong mental model. IRAP alignment is an engineering practice: the security controls that IRAP assessors evaluate should be embedded in the platform architecture from day one, not retrofitted before assessment.
Organisations that treat IRAP as an audit consistently discover expensive remediation requirements. Organisations that engineer for IRAP alignment from the outset reach assessment readiness faster and with far less rework.
The Protective Security Policy Framework (PSPF) and ISM
IRAP assessment evaluates alignment with the Australian Government Information Security Manual (ISM) and the Protective Security Policy Framework (PSPF). Understanding these frameworks is prerequisite to engineering for IRAP alignment.
The ISM provides control guidelines across domains including access control, cryptography, network security, and system monitoring. Controls are classified by information classification โ Official, Protected, Secret, Top Secret โ and the applicable controls for a given system depend on the classification of information it handles.
Platform Engineering for IRAP Alignment
Identity and Access Management
IRAP-aligned platforms require strong identity controls:
- Multi-Factor Authentication (MFA) mandatory for all privileged access
- Privileged Identity Management (PIM) for just-in-time privileged access
- Conditional Access Policies enforcing device compliance, location restrictions, and session controls
- Separation of duties preventing single accounts from having both administrative and operational access
Azure Entra ID (Azure AD) provides the foundation; the engineering work is in configuring these controls correctly and enforcing them via policy.
Network Security
Network architecture for IRAP-aligned systems typically requires:
- Network segmentation isolating workloads based on data classification
- Private endpoints for all PaaS services (no public internet exposure for storage, databases, or key vaults)
- Web Application Firewall (WAF) for internet-facing workloads
- DDoS Protection at the network level
- Network security group (NSG) logging for traffic visibility
Encryption
ISM controls require encryption at rest and in transit. In Azure:
- Azure Storage, SQL Database, and Cosmos DB provide transparent encryption at rest by default โ but customer-managed keys (CMK) are required for higher classifications
- TLS 1.2 minimum for all data in transit
- Azure Key Vault for cryptographic key management with appropriate access controls and audit logging
Logging and Monitoring
IRAP-aligned platforms require comprehensive audit logging:
- Azure Activity Log capturing all resource management operations
- Azure Monitor and Log Analytics for operational telemetry
- Microsoft Sentinel for security information and event management (SIEM)
- Log retention aligned to ISM requirements
- Alerting for security-relevant events
Vulnerability Management
Continuous vulnerability management is an ISM requirement:
- Microsoft Defender for Cloud for vulnerability assessment across compute and container workloads
- Automated patching via Azure Update Manager
- Container image scanning in CI/CD pipelines
- Regular penetration testing (IRAP assessors will expect evidence of testing)
The Assessment Process
An IRAP assessment involves an IRAP-accredited assessor reviewing the system against applicable ISM controls. The assessor produces a Security Assessment Report (SAR) documenting control alignment and residual risks.
Engineering teams should expect the assessment to be evidence-based: the assessor will want to see configuration evidence, not just documentation. Azure Policy compliance reports, Defender for Cloud assessments, and architecture documentation all contribute to assessment evidence.
Conclusion
IRAP alignment is achievable for Azure-hosted systems โ Microsoft maintains IRAP-assessed services that provide a strong foundation. The engineering work is in implementing the controls correctly, documenting the control implementation, and maintaining ongoing compliance.
Organisations that engage IRAP-experienced platform engineers from the outset consistently reach assessment readiness faster and with fewer remediation cycles.