Australia · IRAP · CREST ANZ · ISM · CPS 234

IRAP assessments and CREST testing in Australia, run end to end by Sumrite.

Australian government agencies and the cloud and service providers that serve them need IRAP assessments; regulated entities and buyers often ask for CREST ANZ testers. Sumrite runs the engagement and routes the accredited step through its Australian partners.

Get a quoteAll accredited testing
IRAP and CREST ANZ partnersAccredited work issued through Sumrite’s partners in Australia.
ISM and CPS 234Findings mapped to the ISM and APRA CPS 234.
One teamScoping, fixes and retest with Sumrite.

The Infosec Registered Assessors Program (IRAP) is run by the Australian Signals Directorate. IRAP assessors evaluate systems, including cloud services, against the Information Security Manual (ISM) for Australian government use. CREST ANZ accredits penetration testing companies in Australia and New Zealand. Sumrite runs these engagements end to end and routes the accredited step through its Australian partners.

Who needs it

WhoWhen it applies
Australian government agenciesIRAP assessments of systems before and during use
Cloud and SaaS providersIRAP assessments to sell into government
APRA regulated entitiesSystematic testing of controls under CPS 234
Enterprise buyersContracts that ask for a CREST ANZ accredited tester

How Sumrite delivers it

Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.

  1. Confirm the requirement. IRAP assessment, CREST ANZ testing, Essential Eight maturity or CPS 234 evidence.
  2. Scope and NDA. Systems, classification level and assessment boundary agreed first.
  3. Testing and assessment. Penetration testing by Sumrite and the partner; IRAP assessment by the registered assessor.
  4. Report and retest. Findings mapped to ISM controls, fixed and retested.
RegionPenetration testing in AustraliaCPS 234, Essential Eight and the Privacy Act.FrameworkAPRA CPS 230 and 234Operational resilience and information security testing.FrameworkAustralia Privacy ActSecurity of personal information.
IndiaCERT-In empanelled auditGovernment systems and websites, SEBI regulated entities, tenders that name CERT-InGlobalCREST accredited testingBanks, regulators, enterprise buyers and tenders that ask for CRESTSaudi ArabiaNCA licensed testingGovernment entities, critical national infrastructure and their suppliers

Frequently asked questions

What is an IRAP assessment?

An assessment by an ASD-endorsed IRAP assessor of how well a system implements the controls in the Information Security Manual.

Is IRAP the same as a penetration test?

No. IRAP is a controls assessment; penetration testing is often part of the evidence it reviews.

Can Sumrite deliver IRAP or CREST ANZ testing?

Yes, through Australian partners that hold them, with Sumrite running the engagement end to end.

Accredited testing

All schemes and regionsCERT-In empanelled audit (India)CREST accredited testing (Global)NCA licensed testing (Saudi Arabia)

Need a test a regulator or buyer will accept?

Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.

Get a Quote