What is the difference between an IRAP assessment and an IRAP certification?

The Australian Signals Directorate (ASD) does not issue IRAP certifications. An IRAP assessment is an independent evaluation conducted by an ASD-endorsed assessor against the Information Security Manual (ISM). Claiming an MSP is 'IRAP certified' because they host virtual machines in Azure or AWS is misleading marketing; the provider's specific management plane, tools, and staff must be formally assessed.

What are the four core tiers of the Defence Industry Security Program (DISP)?

DISP encompasses four membership levels: Entry Level (unclassified/baseline), Level 1 (CONFIDENTIAL / Australian Government Security Vetting Agency Baseline), Level 2 (SECRET / Negative Vetting 1), and Level 3 (TOP SECRET / Negative Vetting 2). Each tier enforces strict governance, personnel security, physical security, and cyber security baselines.

How do buyers spot rate card bait-and-switch tactics on the DTA BuyICT panel?

Vendors on the Digital Transformation Agency (DTA) BuyICT panel often bid highly credentialed senior engineers (SFIA Level 5 to 7) to win government tenders, then substitute unvetted junior contractors (SFIA Level 3) post-award while billing maximum contracted rates. Procurement contracts must mandate named-resource clauses and explicit approval for personnel substitutions.

Federal Government DISP & IRAP MSP Buyer Guide

The Sovereign Imperative in Australian Public Sector Procurement

Australian Commonwealth departments, non-corporate Commonwealth entities (NCEs), statutory authorities, and Defence industry prime contractors face an uncompromising procurement environment. Under the statutory mandates of the Public Governance, Performance and Accountability Act 2013 (Cth) (PGPA Act), the Commonwealth Procurement Rules (CPRs), and the Protective Security Policy Framework (PSPF), Australian government buyers are legally accountable for the integrity of their data, supply chains, and sovereign infrastructure.

Simultaneously, the Department of Defence's Defence Industry Security Program (DISP) mandates strict security practices across contractors handling sensitive Defence materiel, supply chain logistics, and capability designs.

Despite these stringent rules, commercial Managed Service Providers (MSPs) routinely pursue Commonwealth contracts using misleading marketing claims. Vendors frequently boast that their private cloud or managed desktop solution is "IRAP Certified" or "Defence Grade," while their actual operations utilize offshore Tier 1 helpdesks, uncleared engineers, and unassessed remote monitoring tools.

When an MSP fails a security audit or experiences an intrusion, Commonwealth executives and departmental secretaries bear direct parliamentary and public scrutiny.

This procurement playbook provides government IT leaders, commercial directors, and DISP Chief Security Officers (CSOs) with the frameworks necessary to evaluate managed service providers, eliminate contracting traps, and enforce genuine sovereign compliance.

1. Unmasking the "IRAP Certified" Marketing Deception

The most pervasive and dangerous marketing tactic in the Australian IT channel is the claim that a provider is "IRAP Certified."

The Australian Signals Directorate (ASD) does not certify products, managed services, or cloud providers under the Information Security Registered Assessors Program (IRAP). IRAP is an assessment framework, not a formal stamp of endorsement:

An IRAP assessment is an independent point-in-time review conducted by an ASD-endorsed assessor against the controls of the ASD Information Security Manual (ISM).
The assessor produces an IRAP Assessment Report and a Security Assessment Report (SAR) identifying residual security risks.
The departmental Authorizing Officer (AO) or delegate reviews these reports and decides whether to grant an Authority to Operate (ATO).

The Scope Boundary Trap

Commercial MSPs routinely host client virtual machines in Microsoft Azure Australia Central (Canberra) or AWS Sydney, then market their entire managed service as "IRAP Assessed." This claim conceals critical operational vulnerabilities:

The Infrastructure Boundary: While Azure and AWS data centers hold comprehensive IRAP assessment documentation for their physical and hypervisor layers, that assessment does not extend to the MSP managing the environment.
The Unassessed Management Plane: If the MSP accesses your cloud environment using commercial Remote Monitoring and Management (RMM) software, SaaS ticketing systems hosted in the United States, or shared jump hosts, that management plane sits outside the assessed boundary.
The Unvetted Service Desk: If helpdesk tickets, network architecture diagrams, and credential vaults are accessed by technicians who lack security clearances or operate from overseas locations, the environment violates Commonwealth security baselines.

Procurement Verification Rule

Require prospective MSPs to supply their complete, unabridged IRAP Assessment Report and System Security Plan (SSP). The assessment must explicitly include within its scope the provider's centralized management tooling, internal corporate network, ticketing platform, and remote administration pathways. If the MSP provides only the cloud hyperscaler's IRAP executive summary, disqualify the bid.

2. DISP Security Tiers and Personnel Clearance Governance

The Defence Industry Security Program (DISP), administered by the Defence Security and Vetting Service (DSVS) under the Defence Act 1903 (Cth), enables Australian industry to partner securely with Defence. DISP membership is organized into four discrete tiers across four security disciplines:

Governance: Security governance frameworks, appointment of a Chief Security Officer (CSO) and Security Officer (SO), and foreign ownership, control, or influence (FOCI) disclosures.
Personnel Security: Verification of Australian Government Security Vetting Agency (AGSVA) clearances for all personnel accessing classified information or assets.
Physical Security: Certification of facilities, server rooms, and communication centers against ASIO Technical Security Standards and the PSPF.
Cyber and Information Security: Adherence to the ASD ISM and achievement of verified Essential 8 Maturity Levels (Maturity Level 2 or Level 3).

DISP Membership Discipline Matrix

Before engaging an IT provider to support Defence projects or dual-use supply chain networks, verify their standing across all four disciplines:

Entry Level (Unclassified / Baseline Security): Organization handles unclassified Defence information. Requires basic governance, verified identity checks, and adherence to baseline cyber hygiene.
Level 1 (CONFIDENTIAL / AGSVA Baseline): Required for handling CONFIDENTIAL materiel. Technicians must hold active AGSVA Baseline security clearances, and facilities must meet PSPF Zone 3 standards.
Level 2 (SECRET / Negative Vetting 1): Required for SECRET Defence projects. Technicians must hold active Negative Vetting Level 1 (NV1) clearances, server rooms must achieve PSPF Zone 4 certification, and networks must enforce ASD Essential 8 Maturity Level 2.
Level 3 (TOP SECRET / Negative Vetting 2): The highest assurance level. Demands Negative Vetting Level 2 (NV2) or Positive Vetting (PV) cleared engineers, TEMPEST-shielded facilities, dedicated sovereign hardware, and full ASD Essential 8 Maturity Level 3 hardening.

Commercial providers often claim "DISP alignment" or show an Entry Level certificate while bidding on tenders requiring Level 2 infrastructure. Require proof of current DSVS membership certificates verifying the exact clearance level for each discipline.

Examine prevailing regional compensation rates for cleared engineers using our Canberra Salary Matrix to verify whether vendor rate cards match real-world NV1 and NV2 labor costs.

3. DTA BuyICT Panel Contracting Traps

Commonwealth buyers procure managed IT services, cloud systems, and professional labor predominantly through the Digital Transformation Agency (DTA) BuyICT.gov.au panels (including the Cloud Marketplace and Digital Marketplace).

While BuyICT simplifies procurement, commercial vendors exploit common contractual loopholes that transfer operational risk back to departments:

Trap A: The Skills Framework for the Information Age (SFIA) Bait-and-Switch

Under BuyICT, providers submit labor rate cards mapped to SFIA levels (SFIA Level 1 through 7). During tender submissions, the MSP showcases senior enterprise architects and principal engineers (SFIA Level 5 to 7) with extensive Commonwealth credentials.

Once the contract is signed, the MSP replaces these named senior consultants with junior Level 3 helpdesk technicians, billing the department at maximum contracted rates.

Remedy: Mandate Named Personnel Clauses in your Statement of Work (SOW). Require that any staff substitution requires 30 days of prior written departmental approval, accompanied by CVs demonstrating equivalent or superior SFIA qualifications and security clearances, with an automatic 20% billing discount during the initial 60-day onboarding period.

Trap B: Uncapped Project Scope and Transition-In Creep

Standard SOW templates often define "Transition-In" and "Environment Onboarding" as variable time-and-materials line items. MSPs exploit ambiguous handover documentation to spend months in discovery, billing hundreds of hours at premium hourly rates while standard support tickets languish.

Remedy: Structure all transition, cloud migration, and environment hardening work as Fixed-Price Milestone Deliverables. Link invoice payments directly to formal technical acceptance criteria, including signed-off System Security Plans (SSPs), successful backup restore validations, and clean vulnerability scans.

Review complete contract evaluation strategies using our Contract Grader to identify risky time-and-materials provisions before execution.

4. Provider Comparison: Commercial IT Outsourcer vs. Sovereign Gov MSP

Compare prospective vendors against this mandatory sovereign procurement standard:

Procurement & Security Dimension	Commercial IT Outsourcer	Cleared Sovereign Defence & Gov MSP
IRAP Boundary Assessment	Relies on underlying cloud provider certification	Complete MSP management plane & tools independently IRAP-assessed
Personnel Security Clearances	Unvetted civilian engineers; offshore support	100% Australian citizens with active AGSVA NV1 or NV2 clearances
DISP Membership Level	None or Entry level only	Active Level 2 or Level 3 certified DISP Member organization
NOC / SOC Operating Location	Follow-the-sun offshore support model	100% Australian sovereign on-soil 24/7 Security Operations Centre
DTA BuyICT Rate Transparency	Blended rates hiding 40%+ offshore arbitrage	Transparent BuyICT rate card matched to SFIA Level 4–7 skills
PSPF Data Residency Guarantee	Telemetry and metadata transit offshore	Zero offshore data transit; all telemetry retained in Australia
Essential 8 Implementation	Maturity Level 0 or 1 (self-assessed)	Independently audited Maturity Level 2 or Level 3 across all tools
Supply Chain Accountability	Subcontracts after-hours triage to third parties	Zero unauthorized subcontracting; direct sovereign employment

Evaluate head-to-head operational capabilities between major Australian government providers using our Compare MSPs tool, or run candidate contracts through our automated Red Flag Scanner.

5. Sovereign Supply Chain Mandates: 100% On-Soil Support

Under PSPF Policy 8 (Sensitive and classified information) and Policy 10 (Safeguarding data from foreign interference), Commonwealth entities must guarantee that data classified as PROTECTED or higher remains entirely within Australian sovereign jurisdiction.

Data sovereignty encompasses far more than data at rest inside an Australian data center:

Routing and Telemetry: Telemetry generated by endpoint detection systems, firewall syslog streams, and ticketing databases must not route through international proxy nodes or offshore analysis engines.
Remote Administrative Access: An engineer logging in from an offshore subsidiary or overseas home office creates an active data transit path, subjecting system memory and cached files to foreign legal jurisdictions (such as the US CLOUD Act or foreign intelligence surveillance laws).
Foreign Ownership, Control, or Influence (FOCI): Under DISP mandates, entities must disclose whether foreign parent corporations, investors, or overseas boards can exert operational control over technical infrastructure or personnel decisions.

Contractual Sovereignty Clause

Enforce this explicit clause in all Commonwealth IT services contracts:

"The Service Provider warrants that 100% of data, telemetry, backup images, configuration files, and metadata will reside exclusively within the Commonwealth of Australia. The Service Provider further covenants that all operational, administrative, and technical support services will be performed exclusively by Australian citizens holding active AGSVA clearances, physically present within the Commonwealth of Australia, with zero remote access permitted from outside Australian sovereign territory."

6. Exit Strategy, Transition-Out, and De-Classification Governance

A critical requirement under Section 8 of the Commonwealth Procurement Rules is ensuring continuous accountability and value for money through the full procurement lifecycle, including disengagement.

Commercial MSPs frequently build technical lock-in into Commonwealth environments:

Deploying proprietary scripts that render automated backups unreadable without vendor software.
Registering departmental cloud subscriptions, tenant root accounts, or domain name records under the MSP's administrative entity.
Demanding exorbitant off-boarding consulting fees to transfer environment documentation, encryption keys, and historical audit logs.

Enforcing Clean Disengagement

To maintain sovereign control, contracts must incorporate strict de-coupling protections:

Direct Tenant Ownership: All cloud tenancies (Microsoft 365, Azure, AWS), software licenses, and domain registrations must be registered directly in the Commonwealth department's name, with departmental administrators retaining break-glass global administrator access.
Contractually Capped Transition-Out Rates: Transition-out assistance must be provided at the standard contracted BuyICT SFIA rates without emergency surcharges or exit penalties.
Secure Data Sanitisation: Following transition, the outgoing MSP must sanitize all client data from its management repositories in accordance with the sanitization guidelines detailed in the ASD Information Security Manual (ISM), providing an authorized Certificate of Destruction within 30 days.

Review step-by-step handover protocols and exit covenants in our comprehensive Vendor Exit Guide.

Commonwealth IT Buyer Verification Checklist

Prior to awarding any managed services, cloud management, or cybersecurity contract, confirm these mandatory requirements:

[ ] Unabridged IRAP Assessment Report and System Security Plan (SSP) covering all MSP management tools
[ ] Active DISP Membership certificate verifying appropriate tier (Level 1, 2, or 3)
[ ] Verification of 100% Australian citizenship and AGSVA security clearances (Baseline/NV1/NV2)
[ ] Binding contractual guarantee of 100% sovereign Australian on-soil support and zero offshore telemetry
[ ] BuyICT SOW containing Named Personnel Clauses and fixed-price transition milestones
[ ] Audited adherence to ASD Essential 8 Maturity Level 2 or 3
[ ] Direct departmental ownership of cloud tenancies and clear ISM-compliant data sanitization covenants