FAQS

It is unlikely Redacted consultants will be engaged to sit in your office from 9 to 5 each day to complete the IRAP. Redacted conducts the bulk of the assessment remotely, unless there is a compelling reason to perform the documentation assessment onsite. This can be done using Redacted corporate cloud systems where the system documentation is below PROTECTED. Where the system documentation is PROTECTED or above Redacted will conduct the documentation assessment remotely, using infrastructure provided by the client.

After the initial report is delivered, Redacted assessors will decide which formats of evidence are required to assess physical implementation of controls as described in documentation. These could include interviews, witnessing configurations on screen, screenshots of configurations, or in some cases even parsing a standard operating environment disk image. Some of the evidence gathering can be conducted remotely, and some will require assessors to physically attend a location with a system administrator, or system component. Where possible Redacted chooses to work remotely.

After evidence is gathered a final report will be made, and a review process follows. We find it is necessary to conduct a face to face meeting at the delivery of the initial report to go through the final report.

An assessment can take anywhere from 2 – 6 months. Smaller systems, with a short technology stack can take as little as two months. The larger the system, the longer it will take. In 99% of cases assessment delays are caused by the client organisation. This most commonly happens either just before, or just after the initial report is delivered. Often it is derived from an idea that system documentation and control implementation can be done during the IRAP assessment after some higher risk items have been located. However, it is not possible to do this, and we advise organisations to make themselves ready for the assessment before Stage 1 begins.

Redacted prices every assessment bespoke. In our initial scoping meeting we will require information about the system so we can get an idea of the boundaries, stack, and architecture of what is being looked at. This then allows us to determine how long the assessment will take, how complex it will be, and how much it will cost to complete it.

Redacted charges a flat fee (rather than time based rates) for all IRAP consulting. We believe this represents a greater value for money and cuts straight to purpose of IRAP assessments. The purpose of an IRAP assessment is to provide a report, which contains within a risk based assessment of the implementation of security controls on the system as they align to the Information Security Manual. The number of hours or days it takes the IRAP assessors is not relevant to the quality of the report, nor it’s utility. Because of this Redacted does not consider contracting by the hour or day to be a credible method of engagement for IRAP assessments. There is greater certainty in this method for the client, as they have known expenditure as well as an assurance of quality without continuing to keep a contractor on board for review cycles.