IRAP 2.0: The IRAP-ening. What does it take to be an assessor?

If you've spent any time working in Australian government security, you've almost certainly encountered the acronym IRAP and probably walked away with more questions than answers. What actually is it? Who does it? How do you become one? And what does an assessment actually look like in practice?

This talk cuts through the ambiguity and gives you a ground-level view of the Information Security Registered Assessors Program, what it is, where it sits in the broader policy landscape, and what it genuinely takes to become a registered assessor.

We'll start with the foundations. IRAP exists within a layered policy ecosystem anchored by the Protective Security Policy Framework (PSPF) and given technical teeth by the Information Security Manual (ISM). The PSPF sets the why: government entities must protect their information and systems; while the ISM sets the how: providing the controls and guidelines that assessors evaluate against. IRAP is the who: the mechanism by which the Australian Signals Directorate (ASD) authorises qualified individuals to independently assess whether systems meet those requirements. Understanding how these three frameworks interlock is essential before you can meaningfully engage with any of them.

From there, we'll look at what it actually takes to become a registered assessor. The pathway is more structured than many people realise. Candidates must demonstrate a combination of formal qualifications, relevant industry experience, and completion of ASD-endorsed training - including the endorsed assessor course delivered through the Australian Information Security Academy, where Remy serves as Head Instructor. We'll walk through the eligibility requirements, the endorsement process, and what the ongoing obligations of maintaining your registration look like; because becoming an assessor isn't a one-time achievement, it's a continuing commitment.

Finally, we'll demystify what an IRAP assessment actually is. From scoping and threat modelling through to control evaluation, evidence gathering, and producing the assessment report, attendees will come away with a realistic picture of what the engagement looks like end-to-end, including the parts that rarely get talked about: the complexity of scoping decisions, managing assessor independence, and navigating the gap between what a control says and what a system does.

Whether you're a security professional considering the IRAP pathway, a system owner preparing for an assessment, or simply trying to understand how Australian government cyber assurance actually works, this talk will give you the clearest picture you've had yet.