ASD ISM 0100 Regular IRAP assessment of sensitive gateways
What it says
Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSensitive gateways must have an IRAP assessment at least every two years using the latest ISM standards.
This control is about making sure that the security systems protecting sensitive information are regularly checked and kept up to the latest standards. If these gateways aren't checked every two years, they might become outdated, leaving your organisation open to data breaches or cyber-attacks that could compromise important information.
Free. Save your status, tasks and notes.
Why it matters
Without 24‑monthly IRAP assessments, OFFICIAL: Sensitive/PROTECTED/SECRET gateways can retain unaddressed ISM gaps, increasing compromise risk and data exposure.
How to implement
The IT team should schedule regular assessments: Set up a recurring calendar reminder every two years to initiate an assessment for your sensitive gateways, ensuring they're inspected against the most recent security standards available.
The system owner should gather relevant information: Collect any documentation, configuration details, and vendor contacts related to the current setup of your gateways to prepare for the assessment.
Management should appoint an IRAP assessor: Contact a certified IRAP assessor who is familiar with Australian Signals Directorate (ASD) standards and arrange for their review of your gateways.
The assessor and IT team should work together during the assessment: Collaborate to ensure the assessor understands your systems, provides accurate feedback, and notes areas that need improvement.
The IT manager should implement recommended changes: Based on the assessor's findings, create a timetable to update and fix identified issues in your system, ensuring changes are documented for accountability.
Keep it running
Schedule IRAP for each sensitive gateway at least every 24 months, and ensure the assessor uses the latest ISM release available before the assessment (or later); retain reports and evidence.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
The latest IRAP assessment report: Request a copy of the report completed by the certified assessor, detailing the findings and any recommendations for improvements.
Look at
The calendar or task management system: Check if there is a recurring task or reminder set every two years for conducting these assessments.
Good evidence
Includes documented reminders and past completion dates.
- Check 2 of 2What an auditor asks for
Ask for
How they prepare for and conduct an IRAP assessment.
Good evidence
Involves mentioning document collection, liaising with assessors, and following up on recommendations.
Mappings
Closest match in ISO/IEC 27001: A.5.35, Independent review of information security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.5.35.
ISM-0100 requires non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways to undergo an IRAP assessment against a current ISM release at least every 24 months. An IRAP assessment is an independent review of how security is implemented for the gateway, so it is a specific instance of the independent review of information security required by Annex A 5.35. Annex A 5.35 applies to the organisation's whole approach to managing information security (people, processes and technologies) at planned intervals or after significant change, whereas ISM-0100 is limited to gateways and sets a fixed maximum interval.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.