Australia ISM & IRAP

Introduction to the Australian ISM and IRAP

The Australian Government Information Security Manual (ISM) is the cornerstone cyber security framework produced by the Australian Signals Directorate (ASD) through its Australian Cyber Security Centre (ACSC). It sets out a risk-based, principles-plus-controls approach that organisations use to protect their systems, applications and data from cyber threats. The Information Security Registered Assessors Program (IRAP) is the complementary assessment scheme: it endorses suitably qualified and independent assessors who evaluate the security posture of systems against the ISM and, where relevant, the Protective Security Policy Framework (PSPF), producing an IRAP assessment report that informs an authorising officer's risk-based decision to authorise a system to operate.

This guide is written for two audiences at once. For the auditor or IRAP assessor, it enumerates the cyber security principles, the ISM guidelines (control domains), the maturity model of the Essential Eight, and the discipline of gathering objective evidence to support control effectiveness findings. For the implementer, CISO or security-uplift lead, it lays out how to scope a system, tier controls by data classification, run a phased implementation, and prepare for an IRAP assessment so the resulting report supports an authorisation to operate (ATO). Throughout, this article uses British and Indian English conventions and reflects the ISM as maintained on a quarterly release cadence by the ACSC.

What is the ISM / IRAP

The ISM is a living document. Rather than being a static standard frozen at a point in time, the ACSC re-issues it approximately every quarter (historically March, June, September and December) with new, amended and retired controls, each carrying a unique numeric control identifier and a first-published and last-updated date. This cadence lets the framework track emerging threats such as ransomware, supply chain compromise, cloud misconfiguration and identity attacks. The ISM is structured around a small set of enduring cyber security principles supported by a large body of prescriptive, testable controls grouped into thematic guidelines.

The ISM's principles are organised under four activities that describe the lifecycle of a cyber security function: Govern (identify and manage security risks), Protect (implement controls to reduce risk), Detect (identify and understand cyber security events) and Respond (respond to and recover from cyber security incidents). These map deliberately onto internationally recognised functions and give organisations a common vocabulary for describing capability.

IRAP is the assessment vehicle. An IRAP assessor is an individual endorsed by the ASD who holds relevant qualifications and security clearance and who has passed the IRAP training and examination. IRAP assessors are independent of the systems they assess. Their role is not to authorise a system - that authority rests with the system owner's authorising officer - but to provide an objective assessment of the implementation and effectiveness of controls, identify residual risks, and document them so the authorising officer can make an informed, risk-based ATO decision. IRAP is frequently used to assess cloud service providers, gateways, and government or government-adjacent systems handling OFFICIAL, OFFICIAL: Sensitive, PROTECTED, SECRET and TOP SECRET information.

Who must comply and scope of applicability

The ISM is mandated for non-corporate Commonwealth entities (NCCEs) through the PSPF, which directs entities to apply the ISM's cyber security principles and controls commensurate with the sensitivity or classification of the information they hold. Corporate Commonwealth entities and wholly-owned Commonwealth companies are strongly encouraged to apply it. Beyond the direct mandate, the ISM's reach extends across the economy because it is the de facto benchmark used to establish trust with government.

Scope of applicability within an organisation is set by identifying the systems that store, process or transmit government or otherwise sensitive information, and by the highest classification of data handled. A system's classification (OFFICIAL through TOP SECRET) determines the depth of controls required, the physical and personnel security posture, the caveats and compartments in play, and whether the system must sit in an accredited facility.

Structure of the ISM / IRAP

The ISM is built in layers: the cyber security principles at the top set direction; the guidelines (control domains) group the detailed controls thematically; and each control carries a unique identifier, an applicability marking by classification, and a description of the required outcome. The table below sets out the major structural elements a reader will encounter.

Master assessment checklist

This is the operational heart of the guide. The subsections below walk through each ISM guideline (control domain) as an assessment area. For every area we provide what an assessor should verify and the typical objective evidence that demonstrates control effectiveness. This is intended to be comprehensive across the ISM's guidelines; use it alongside the current ISM release to confirm control identifiers and applicability by classification, and record findings as Effective, Ineffective, Partially effective or Not applicable with residual risk noted.

Cyber security roles, governance and risk management

Guidelines for cyber security incidents

Guidelines for procurement and outsourcing

Guidelines for security documentation

Guidelines for physical security

Guidelines for personnel security

Guidelines for communications infrastructure and communications systems

Guidelines for enterprise mobility

Guidelines for evaluated products and ICT equipment

Guidelines for media

Guidelines for system hardening

Guidelines for system management

Guidelines for system monitoring

Guidelines for software development

Guidelines for database systems

Guidelines for email

Guidelines for networking

Guidelines for cryptography

Guidelines for gateways

Guidelines for data transfers

Cloud computing and Essential Eight (cross-cutting)

Scoping, materiality and tiering

ISM controls are not applied uniformly; they are tiered by the classification of the information a system handles. The higher the classification, the more controls apply and the more stringent their implementation. Scoping therefore begins with a data classification exercise and a system boundary definition.

Materiality also flows from the aggregation of data (many low-classification records may aggregate to a higher effective sensitivity), the criticality of the system to business or national outcomes, and the threat exposure (internet-facing versus air-gapped). Where a control cannot be met as written, the ISM permits alternative controls or a formal risk acceptance, provided the residual risk is documented and accepted by the authorising officer.

Implementation approach

A pragmatic ISM implementation follows a phased path from discovery to sustained assurance. Each phase produces deliverables that feed the eventual IRAP assessment and ATO.

Phase 1 - Discovery and scoping

• Classify information and define system boundaries and data flows
• Identify system owner, authorising officer and stakeholders
• Establish the applicable classification and therefore the applicable ISM control set
• Assess whether an IRAP assessment will be required and to what depth

Deliverables: system inventory, data classification register, scope statement, high-level architecture and data-flow diagrams.

Phase 2 - Gap assessment

• Map current controls to the applicable ISM guidelines and controls
• Perform a maturity assessment of the Essential Eight against the target level
• Identify gaps, alternative controls and areas needing risk acceptance
• Prioritise remediation by risk and effort

Deliverables: control matrix / statement of applicability, gap register, prioritised remediation plan, Essential Eight maturity baseline.

Phase 3 - Remediation and control implementation

• Implement technical controls (hardening, patching, MFA, logging, segmentation, encryption)
• Implement process controls (change, incident, access recertification, backup testing)
• Deploy or configure tooling (SIEM, PAM, MDM, application control, DLP)
• Update documentation - SSP, SOPs, incident and continuity plans

Deliverables: implemented controls with evidence, updated SSP, SOP suite, remediation closure records.

Phase 4 - IRAP assessment and authorisation

• Engage an ASD-endorsed IRAP assessor to conduct Stage 1 (documentation) and Stage 2 (implementation) review
• Support evidence gathering, walkthroughs and technical testing
• Receive the IRAP assessment report with findings and residual risks
• Present residual risks to the authorising officer for an ATO decision

Deliverables: IRAP assessment report, security assessment report, plan of action and milestones (POA&M), signed ATO.

Phase 5 - Continuous assurance

• Operate continuous monitoring, vulnerability management and log review
• Track ISM quarterly releases and update the control baseline accordingly
• Re-assess Essential Eight maturity periodically
• Schedule re-authorisation before ATO expiry and after significant change

Deliverables: continuous monitoring reports, updated risk register, maintained maturity assessments, re-authorisation package.

Maturity and capability model

The Essential Eight Maturity Model (E8MM) is the ISM ecosystem's primary capability model. It defines Maturity Level Zero through Maturity Level Three, describing progressively stronger implementation of the eight mitigation strategies: application control, patch applications, configure Microsoft Office macro settings, user application hardening, restrict administrative privileges, patch operating systems, multi-factor authentication, and regular backups. Target level should be set by threat exposure and risk appetite - many entities target Maturity Level Two, with higher-risk systems targeting Level Three.

Maturity should be assessed as an aggregate - an entity is only at a level if all eight strategies meet that level's requirements. Assessments may be self-assessed or, for higher assurance, conducted independently by an IRAP assessor or ASD-recognised provider.

Assessment and audit approach

An IRAP assessment is a structured, two-stage engagement that mirrors risk-based assurance methodologies. The following steps describe the end-to-end approach an assessor and organisation will follow.

1. Scope and plan the assessment: confirm system boundary, classification, applicable controls and assessment stages with the IRAP assessor and system owner.
2. Stage 1 - security assessment planning and documentation review: examine the SSP, control matrix, risk assessment and supporting documentation for completeness and adequacy of design.
3. Stage 2 - control implementation and effectiveness review: conduct interviews, configuration inspection, sampling and technical testing to confirm controls operate as documented.
4. Gather objective evidence for each in-scope control and record an effectiveness finding with supporting rationale.
5. Identify residual security risks where controls are ineffective, partially effective or replaced by alternatives, and assign risk ratings.
6. Produce the IRAP assessment report and security assessment report documenting findings, residual risks and recommendations.
7. Develop a plan of action and milestones (POA&M) to remediate outstanding weaknesses over time.
8. Present the assessment outputs to the authorising officer, who makes a risk-based authorisation to operate decision.
9. Establish continuous monitoring and schedule re-assessment before ATO expiry or after significant change.

Evidence request list

Assessors will request evidence across governance, technical and operational categories. Organising an evidence library ahead of assessment materially shortens the engagement.

• Governance: cyber security strategy, policy suite, CISO/system-owner appointments, risk register, risk acceptances, previous ATO letters
• Documentation: system security plan, control matrix / statement of applicability, SOPs, incident response plan, business continuity and disaster recovery plans
• Architecture: network and data-flow diagrams, system boundary definition, asset and configuration inventory (CMDB)
• Access management: identity provider configuration, MFA coverage, privileged access management records, access recertification evidence
• Hardening and configuration: OS and application hardening baselines, benchmark scan results, application control policy and logs
• Vulnerability and patch: vulnerability scan reports, patch compliance dashboards, remediation SLAs and records
• Monitoring and logging: logging policy, SIEM configuration, sample log extracts, alerting rules, SOC runbooks
• Cryptography: approved-algorithm configuration, key management plan, HSM/TLS/IPsec settings
• Backup and recovery: backup schedules, restore-test evidence, immutable/offline backup arrangements
• Personnel and physical: clearance records, training and awareness completion, facility certifications, physical access logs
• Supplier and cloud: vendor risk assessments, CSP IRAP reports, shared-responsibility matrices, contracts and security schedules
• Incident and change: incident register, ReportCyber/ACSC notifications, change records and CAB approvals

Roles and responsibilities

KPIs and metrics to track

• Essential Eight maturity level achieved per strategy versus target
• Percentage of assets patched within defined SLA windows for critical and high vulnerabilities
• MFA coverage across privileged, remote and internet-facing access
• Mean time to detect (MTTD) and mean time to respond (MTTR) for cyber security incidents
• Percentage of systems with a current, valid authorisation to operate
• Backup restore-test success rate and recovery time/point objectives met
• Log coverage percentage against the defined logging matrix
• Number of open high/critical findings and average age of remediation
• Percentage of privileged accounts under PAM and reviewed each cycle
• Security awareness training completion and phishing simulation failure rate
• Number of in-scope cloud services with current IRAP assessments
• Percentage of ISM control matrix items marked Effective versus Ineffective/Partial

Readiness checklist

• Information classified and system boundaries and data flows documented
• System owner and authorising officer identified and engaged
• Applicable ISM control set determined by classification
• System security plan and control matrix completed and current
• Essential Eight assessed against a defined target maturity level
• MFA enforced for privileged, remote and internet-facing access
• Application control and hardening baselines deployed and monitored
• Patch and vulnerability management operating within defined SLAs
• Centralised logging and continuous monitoring in place
• Backups performed, protected and restore-tested
• Incident response plan documented and exercised
• Cloud services and suppliers hold current IRAP assessments where required
• Risk register and residual risk acceptances documented
• Evidence library assembled and mapped to controls
• IRAP assessor engaged and assessment scope agreed
• Re-authorisation and continuous assurance schedule established

Common gaps and findings

• Essential Eight implemented partially - MFA or application control present but not to the claimed maturity level across all systems
• Patch timelines exceeded for internet-facing services, leaving exploitable windows open
• System security plan outdated or missing control implementation detail, so design cannot be verified
• Logging gaps - critical systems not forwarding logs to the SIEM or insufficient retention
• Privileged access sprawl - excessive local admin rights and unmanaged service accounts
• Backups not restore-tested, or backups reachable and mutable from production (ransomware risk)
• Cloud shared-responsibility misunderstood - consumer-side configuration left insecure despite an IRAP-assessed platform
• Alternative controls used without documented, accepted residual risk
• Physical or personnel security not aligned to the classification of information handled
• Authorisation to operate lapsed or granted without addressing known high risks
• Email authentication (DMARC) left at monitor rather than enforcement
• Segmentation weak - flat networks allow lateral movement between trust zones

ISM / IRAP mapped to other frameworks

The ISM shares conceptual DNA with international frameworks, which helps organisations reuse effort and communicate posture to global stakeholders. The mapping below is indicative and directional rather than a control-by-control crosswalk.

Frequently asked questions

Need help with ISM / IRAP?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.