ASD ISM 0100Regular IRAP Assessment of Sensitive Gateways
Official control statement
Non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways undergo an IRAP assessment, using the latest release of the ISM available prior to the beginning of the IRAP assessment (or a subsequent release), at least every 24 months.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Sensitive gateways must have an IRAP assessment at least every two years using the latest ISM standards.
What this means in practice
This control is about making sure that the security systems protecting sensitive information are regularly checked and kept up to the latest standards. If these gateways aren't checked every two years, they might become outdated, leaving your organisation open to data breaches or cyber-attacks that could compromise important information.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Proactive
Classifications
NC, OS, P, S
ISM last updated
Mar 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
Without 24‑monthly IRAP assessments, OFFICIAL: Sensitive/PROTECTED/SECRET gateways can retain unaddressed ISM gaps, increasing compromise risk and data exposure.
Operational notes
Schedule IRAP for each sensitive gateway at least every 24 months, and ensure the assessor uses the latest ISM release available before the assessment (or later); retain reports and evidence.
Implementation tips
- The IT team should schedule regular assessments: Set up a recurring calendar reminder every two years to initiate an assessment for your sensitive gateways, ensuring they're inspected against the most recent security standards available.
- The system owner should gather relevant information: Collect any documentation, configuration details, and vendor contacts related to the current setup of your gateways to prepare for the assessment.
- Management should appoint an IRAP assessor: Contact a certified IRAP assessor who is familiar with Australian Signals Directorate (ASD) standards and arrange for their review of your gateways.
- The assessor and IT team should work together during the assessment: Collaborate to ensure the assessor understands your systems, provides accurate feedback, and notes areas that need improvement.
- The IT manager should implement recommended changes: Based on the assessor's findings, create a timetable to update and fix identified issues in your system, ensuring changes are documented for accountability.
Audit / evidence tips
- AskThe latest IRAP assessment report: Request a copy of the report completed by the certified assessor, detailing the findings and any recommendations for improvements
- Look atThe calendar or task management system: Check if there is a recurring task or reminder set every two years for conducting these assessmentsGoodIncludes documented reminders and past completion dates
- AskHow they prepare for and conduct an IRAP assessmentGoodInvolves mentioning document collection, liaising with assessors, and following up on recommendations
Cross-framework mappings
How ISM-0100 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 5.35 | ISM-0100 requires non-classified, OFFICIAL: Sensitive, PROTECTED and SECRET gateways to undergo an IRAP assessment against a current ISM ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in Gateways
See all Guidelines for gateways controls, or browse the full ASD ISM library.