Although IRAP and Essential Eight assessments aren’t yet formal mandates for the private sector, their steady rise signals an emerging standard for Australian cybersecurity practices.
As someone who’s spent many years working with information security frameworks, I keep an eye on the subtle but meaningful shifts in our industry. Recently, one observation has stood out: The Australian Information Security Manual (ISM) – and its partner in crime, the IRAP Report – are gradually evolving beyond their original government-centric scope to become a trusted benchmark in the broader Australian market.
We’d be foolish to assume this has nothing to do with the confluence of focused efforts from the Department of Home Affairs along with the Australian Cyber Security Centre (ACSC) pursuing agencies along with their partners and supply chains for more diligent attention to cyber resilience. At the same time, it’s not lost that the looming spectre of corporate and personal liability is empowering Infosec leadership to seek out defensible proof of ‘better practice’.
And I concur. The Australian ISM is a reasonable representation of ‘better practice’, and its prescriptive nature brings distinct advantage over other more “choose your own adventure” frameworks. At the same time, the IRAP’s appeal lies in its governed independence and structured transparency, providing line-of-sight clarity to control effectiveness. A win-win for any board looking for establish a sound alibi and stay out of gaol (or even jail).
The Road to Rome
More than mere anecdotal musings, these glimpses of the future can be seen in emerging policy trends. The 2023-2030 Australian Cyber Security Strategy clearly positions Government and Industry as joint stewards of cybersecurity, and commits to “collaborate with industry to design best-practice principles to guide good cyber governance”. A keen eye will spot the shape of things to come: the forthcoming Voluntary Data Classification Framework (VDCF), set for release in late 2025, will align with Australian Government classifications, and thus provide a pre-baked foundation for adoption of ISM into everyday commercial practices.
It’s not lost that we’re also seeing ACSC’s Essential Eight (E8) – a subset of the ISM controls – emerging as mandatory yardstick for organisations, both public and private. Assessments against E8, also overseen by ACSC, are becoming commonplace for commercial entities wanting straightforward evidence of a robust foundational cybersecurity posture.
In short, the growing acceptance of IRAP reports as a benchmark, proactive alignment with the Australian ISM seems a prudent choice – not just for the sake of compliance, but to foster genuine confidence and resilience.