Airlock Digital customers trust our technology to help protect important systems and in return, we need to show that we hold ourselves to the same high standards. That's why I'm pleased to share that Airlock Digital has completed an IRAP assessment at the PROTECTED level.
It's an important milestone for us, particularly as we work with more Australian Government agencies and organisations operating sensitive environments. The IRAP process gave us an opportunity to put our own security practices under scrutiny and prove that the controls we rely on operate effectively.
If you're not familiar with IRAP, it is the Information Security Registered Assessors Program (IRAP) — a program that is run by the Australian Signals Directorate (ASD). IRAP assessors evaluate systems against the security controls in the Australian Government's Information Security Manual (ISM). Those controls cover areas such as system architecture, access management, data protection, vulnerability management, monitoring and incident response. In scope for our assessment were controls at the PROTECTED classification level and controls that applied to our cloud hosted deployment model. For Australian Government organisations, an IRAP assessment provides independent evidence they can use when making their own security and risk decisions.
The immediate reason for undertaking an IRAP assessment was straightforward. We work with Australian Government organisations that operate sensitive systems. They rely on Airlock Digital to prevent unknown and untrusted applications from executing in their environments. If customers are going to trust us with an important part of their security, they should be able to ask hard questions about ours.
The IRAP assessment gives those customers independent evidence they can use when evaluating Airlock Digital.
The ISM and the IRAP assessment process in general is evidence-based and technical. The assessor asks us to demonstrate that what we say we have in place is genuinely in place, and operating effectively. This encompasses everything from policies through to approved encryption algorithms. For us, that made the assessment worthwhile regardless of the compliance requirement. Additionally, an outside perspective can challenge our assumptions and forces us to prove that security works beyond the technology itself.
For our Australian Government customers, the assessment provides another source of independent assurance when evaluating Airlock Digital for environments operating at the PROTECTED level.
It should also make security reviews and Authority To Operate processes more straightforward.
Instead of relying only on what we say about our security, customers can use independent assessment material and supporting documentation as part of their own risk and authorisation processes.
Of course, an IRAP assessment doesn't replace those processes. Every organisation still needs to assess its own environment, architecture and risks. The same is true for our customers outside government. The controls examined through IRAP are part of how we protect the Airlock services they depend on. The assessment gives them another independent data point when judging us as a security vendor.
There is a temptation with any major assessment to see the finish line and declare the job done. Security doesn't work that way.
A control doesn't stay effective because someone assessed it once, and a control's effectiveness deteriorates over time if it is not maintained. At Airlock Digital we are committed to improving our controls. And we have to keep being able to demonstrate that they work. So while I'm proud that Airlock Digital has completed its IRAP assessment at the PROTECTED level, I'm equally pleased with what we learned through the process. For a security company, holding ourselves to the same high standards we help our customers achieve is fundamental to earning and maintaining that trust.
Additional information may be found at www.airlockdigital.com/irap and our IRAP Letter of Assessment and supporting security information will be available through the Airlock Digital Trust Center.
Finally, thank you to everyone across Airlock Digital who contributed to the assessment. Work like this touches engineering, security, infrastructure, operations and governance, and it takes a lot of effort behind the scenes. This was very much a team achievement.