Engagement benchmarks the platform against the Australian Signals Directorate’s Information Security Manual at the PROTECTED level, the baseline agencies apply when evaluating cloud services.
ITASCA, Ill. & WASHINGTON, D.C. – 19 August 2026 – Flexera, a global leader in technology spend and risk intelligence, has engaged 38North Security to conduct an IRAP readiness and prep review of its Flexera One platform against the Australian Government’s Information Security Manual (ISM) at the PROTECTED classification level.
The engagement defines the Australian system boundary for Flexera One, evaluates the platform’s security controls, architecture, and operating model against the ISM PROTECTED baseline, and produces a prioritized roadmap of the work required to reach IRAP readiness. It is a pre-assessment activity: a gap analysis that gives Flexera an evidence-based picture of its current posture ahead of any decision on next steps.
ISM PROTECTED is among the most demanding security baselines applied to cloud services anywhere. It reaches well past conventional control frameworks into data residency and sovereignty, tenant isolation, cryptographic standards, and the Essential Eight mitigation strategies, and it is a benchmark Australian Government agencies apply in deciding which providers may handle sensitive information. For a platform operating at Flexera One’s scale, establishing precisely where it stands against that baseline, and what closing the distance would require, is the groundwork any serious Australian public sector strategy rests on.
“Our customers expect security, transparency, and continuous improvement,” said Conal Gallagher, Chief Information Officer and Chief Information Security Officer at Flexera. “This engagement provides an objective assessment of Flexera One against a key Australian Government security framework and helps us better understand the work required to support organizations operating in highly regulated environments.”
“The providers who succeed in Australia are the ones who do the work in the right order: define the boundary, understand the gaps, then move,” said Matt Earley, Founder and President of 38North Security and a former Australian Signals Directorate official. “We have guided global software and cloud providers through the full IRAP lifecycle, from the first boundary conversation through evidence preparation, assessor engagement, and re-assessment, and we look at the whole Australian picture: the ISM and Essential Eight through to DISP, the Hosting Certification Framework, and critical infrastructure obligations. Flexera is going about this the right way.”
The readiness review is currently underway.
About Flexera
Flexera helps organizations understand and maximize the value of their technology, including the rising costs and risks introduced by AI, saving billions of dollars in wasted spend. Our Flexera One platform connects the dots between what technology you have, how it is used, what it costs, and where it creates risk, helping teams take control of the increasingly complex IT estate across cloud, SaaS and on-premises. We are leading the way to unify IT Asset Management, FinOps, and SaaS Management with high fidelity data from Technopedia, our proprietary reference library of technology asset data, and intelligent automation fueled by AI. That’s why thousands of global organizations rely on the Flexera One platform and Technopedia. Learn more at www.flexera.com.
About 38North Security
38North Security is a cloud security and compliance advisory firm trusted by complex, global organizations. Founded in 2012 by former Australian Signals Directorate official Matthew Earley and headquartered in Washington, D.C. with personnel in Canberra and Sydney, 38North specializes in IRAP advisory and assessment against the ISM and Essential Eight, with expertise spanning DISP, the Hosting Certification Framework, and the Security of Critical Infrastructure Act, alongside FedRAMP, 20x, and DoD advisory and engineering in the United States. 38North is an AWS Advanced Tier Services and Global Security and Compliance Acceleration Partner. Learn more at www.38northsecurity.com.
Media Contacts
Flexera: Bridget Bell, Sr. Director of Brand & Communications, PublicRelations@flexera.com
38North Security: Ingrid Velasquez-Woodley, Sr. Director of Revenue Strategy, ingrid@38northsecurity.com
About the Author
