IRAP is not a penetration testing accreditation. An IRAP assessment is a controls assessment of a system against the Information Security Manual (ISM) at a point in time. A penetration test is one specific input that feeds into that assessment. Most AU government vendors who ask "do we need IRAP or a penetration test?" are asking the wrong question. The correct question is: what does the sponsoring agency require as evidence for this specific system, and does that evidence need to come from an ASD-endorsed assessor, a CREST-accredited provider, or both?
Vendors who submit a CREST penetration test report in response to an explicit IRAP requirement, or who assume that an Essential Eight assessment satisfies an IRAP requirement, have misunderstood three frameworks that operate at three different levels.
Three Frameworks, Three Different Jobs
The ISM is the catalogue of controls. The Essential Eight is a small, high-value subset of that catalogue. IRAP is the act of assessing a system against the ISM. The practical trap is treating Essential Eight maturity as proof of IRAP readiness.
An Essential Eight assessment at ML2 confirms that the eight strategies are implemented to a specific maturity threshold. It does not confirm that the broader ISM control catalogue is satisfied. For a government vendor whose system will store PROTECTED-classified data, an Essential Eight assessment is a floor, not a ceiling.
For how Essential Eight penetration testing works as a distinct engagement from IRAP, the guide to Essential Eight penetration testing in Australia covers what each maturity level requires and what penetration testing can and cannot validate.
Classification Level Determines What You Need
IRAP assessments are required for systems storing or processing Australian Government data at OFFICIAL, OFFICIAL: Sensitive, PROTECTED, and higher classifications. In 2026, IRAP assessment costs range from AUD $40,000 for a straightforward OFFICIAL assessment to AUD $250,000 or more for a complex PROTECTED assessment. Primary cost drivers are the number of in-scope ISM controls, system complexity, and documentation maturity.
The 2026 trend is firmly toward requiring IRAP for OFFICIAL: Sensitive systems where previously only penetration testing evidence was accepted. Vendors whose systems previously operated under OFFICIAL classification with only penetration testing evidence are increasingly finding that the sponsoring agency expects an IRAP assessment before contract renewal.
The documentation lift is the most underestimated cost for vendors approaching IRAP for the first time. Organisations that have not yet prepared a System Security Plan typically need six to eight weeks of preparation before the formal assessor engagement can begin. Confirm the specific requirement with the sponsoring agency before scoping.
Your Last Pentest Is Already Out of Date
Every week you ship without continuous testing is a week a vulnerability goes unseen. See what Capture The Bug finds in your first engagement.
IRAP Assessment vs Penetration Test: What Each Produces
An IRAP assessment is an independent review of a system's security controls against the ISM. The assessor gathers evidence, tests implementation effectiveness, documents limitations, and produces an assessment report plus a controls matrix. An IRAP assessment does not provide certification, accreditation, or authorisation to operate. Assessors do not pass or fail a system. They report on how well the system meets ISM controls and highlight any risks.
A penetration test attempts to exploit vulnerabilities to determine impact. Pentests form an input to an IRAP assessment but never substitute for one. The penetration test evidence sits inside the IRAP documentation package alongside the System Security Plan, configuration reviews, and other ISM control evidence. A vendor who has only a penetration test report has evidence for some ISM controls. They do not have evidence for the governance, personnel security, physical security, and policy controls the IRAP assessment also covers.
ISM control ISM-1163 requires at least annual penetration testing of internet-facing systems. This requirement is validated during the IRAP assessment: the assessor checks that the testing occurred, that findings were documented, and that remediation followed. The penetration test report becomes compliance evidence within the IRAP assessment package. Additional ISM controls mandate testing after significant system changes, meaning a major platform update or cloud migration triggers a new penetration testing obligation independent of the annual cycle.
Who Can Conduct What
Only IRAP-registered penetration testers holding current ASD endorsement can conduct assessments that satisfy government contracting bodies. A CREST-accredited penetration testing provider can conduct penetration testing that satisfies ISM control requirements. They cannot conduct the IRAP assessment itself.
The IRAP assessment must be conducted by an ASD-endorsed assessor. That assessor may accept a recent penetration test report from a CREST-accredited provider as evidence during the assessment. The two provider types are not interchangeable.
For government vendors who need both: a CREST-certified penetration test to satisfy ISM control requirements and an IRAP-ready evidence package, the guide to what happens after a penetration test covers how the remediation and retest cycle produces confirmed evidence that an IRAP assessor will check when reviewing penetration testing as an ISM control output.
Book a scoping consultation to confirm which testing engagement your specific government tender, agency requirement, or IRAP preparation needs.
Plan Your Annual Pentesting Strategy the Right Way
Learn how modern SaaS companies structure pentesting across the year to reduce risk, stay compliant, and avoid last-minute panic before audits.
Frequently Asked Questions
What is the difference between IRAP and a penetration test in Australia?
An IRAP assessment is a controls assessment of a system against the Australian Government Information Security Manual (ISM), conducted by an ASD-endorsed assessor. It produces an assessment report and controls matrix covering governance, physical security, personnel security, and technical controls. A penetration test is a specific input to the IRAP assessment that validates certain technical ISM controls, particularly those related to vulnerability management and system hardening. A penetration test never substitutes for an IRAP assessment. Pentests feed into the IRAP documentation package as compliance evidence for the controls they can validate.
Does a CREST penetration test satisfy IRAP requirements for Australian government vendors?
A CREST penetration test satisfies specific ISM technical controls, including the annual internet-facing system testing requirement in ISM-1163. It does not satisfy the IRAP assessment requirement itself. The IRAP assessment must be conducted by an ASD-endorsed assessor. A CREST-certified penetration test report can be accepted as evidence within an IRAP assessment package, but it cannot replace the full assessment. Vendors who need both should plan for a CREST-certified engagement producing IRAP-ready documentation followed by an ASD-endorsed IRAP assessor engagement.
What classification levels require IRAP in Australia?
IRAP assessments are required for systems storing, processing, or transmitting Australian Government data at OFFICIAL, OFFICIAL: Sensitive, PROTECTED, and higher classifications. There is no single legislative mandate, but the PSPF and individual agency policies require independent assurance, and IRAP is the accepted mechanism. In 2026, the trend is toward requiring IRAP for OFFICIAL: Sensitive systems where previously only penetration testing evidence was accepted. Confirm the specific requirement with the sponsoring agency before scoping your assessment.
How much does an IRAP assessment cost in Australia in 2026?
IRAP assessment costs in 2026 typically range from AUD $40,000 for a straightforward OFFICIAL assessment to AUD $250,000 or more for a complex PROTECTED assessment. Primary cost drivers are the number of in-scope ISM controls, system complexity, and documentation maturity. Organisations that have not yet prepared a System Security Plan typically need six to eight weeks of preparation before the formal assessor engagement begins. Reassessments are typically 40 to 60 percent of the initial assessment cost.
What is the difference between the ISM, Essential Eight, and IRAP?
The ISM is the ASD's comprehensive catalogue of cyber security controls. The Essential Eight is a prioritised subset of eight mitigation strategies from the ISM recommended as a minimum baseline. IRAP is the assessment program through which ASD-endorsed assessors evaluate a system against the ISM. Essential Eight maturity does not imply IRAP readiness. An Essential Eight assessment at ML2 confirms eight specific controls. An IRAP assessment covers the broader ISM control catalogue including governance, physical security, personnel security, communications security, and system security. The PSPF requires non-corporate Commonwealth entities to implement Essential Eight at ML2. Government vendors supplying systems at OFFICIAL or above typically need an IRAP assessment.
