IRAP
The Information Security Registered Assessors Program (IRAP) is an Australian Signals Directorate (ASD) initiative. It uses independent, ASD-endorsed assessors to evaluate cloud services against the Australian Government Information Security Manual (ISM), the security baseline Australian government agencies work from. The assessment identifies how well a service's controls meet that baseline and where residual risk remains, so agencies and regulated organizations can make informed decisions about adopting it. OFFICIAL: Sensitive is one of the Australian government's classification levels for information that could cause limited damage if compromised.
Smartsheet has completed an IRAP assessment at the OFFICIAL: Sensitive level, conducted by Sekuro, an ASD-endorsed IRAP assessor, against the ISM. For Australian government agencies and regulated organizations, it's independent evidence that Smartsheet, and the AI built on it, has been evaluated against the controls they're required to apply. It sits alongside the certifications you already rely on us for, including SOC 2 Type II and ISO/IEC 27001, 27017, 27018, 27701 and 22301.
Questions about IRAP Certification
The Information Security Registered Assessors Program (IRAP) is run by the Australian Signals Directorate. Endorsed assessors independently evaluate cloud services against the Australian Government Information Security Manual (ISM). More information is available from the Australian Cyber Security Centre.
Yes. Smartsheet has completed an IRAP assessment at the OFFICIAL: Sensitive level, performed by Sekuro against the ISM. IRAP is an assessment, not a certification, so it doesn't result in a pass/fail badge. Each agency uses the assessment to make its own risk decision about using Smartsheet.
The assessment covers the Smartsheet platform as a SaaS service, including its AI capabilities, and the governance controls that support it, such as cybersecurity roles and documentation, and supplier and procurement practices. Sekuro, an ASD-endorsed IRAP assessor, evaluated these against the controls in the Australian Government Information Security Manual (ISM) that apply at the OFFICIAL: Sensitive level. Smartsheet's corporate network and end-user devices are outside the scope. Smartsheet can provide assessment documentation to Australian government customers on request, so they can make their own risk determination.
The IRAP assessment evaluates Smartsheet's controls. Your organization remains responsible for deciding whether Smartsheet fits its obligations for the information it will store, and for configuring and using the platform accordingly. Smartsheet can provide documentation related to the assessment to support your review, but each customer needs to make its own determination.
