IRAP and the New ISM: What US Cloud Providers Need to Know
The ISM is changing every quarter, and lately most of it is about AI. Hear from an IRAP assessor and the team that prepares providers for assessment on what it takes to sell into the Australian government market.
Save your seat
Free to attend. Can't make it live? Register and we'll send the recording.
By registering you agree to receive event emails from 38North Security and Schellman. See our privacy policy.
What We'll Cover
Built for US cloud providers entering, or already in, the Australian government market.
Why IRAP, and FedRAMP to IRAP
What carries over from FedRAMP, ISO 27001 and SOC 2, where FedRAMP teams get surprised, and what you can inherit from your cloud provider.
What changed in the ISM
The June and September updates: hardening AI apps, identities and registers for AI agents, and the new controls that apply to every provider, AI feature or not.
Scoping it right on day one
System boundaries, privileged access, and data sovereignty, including the newest question agencies ask: where does your AI model run?
Changes and assessment strategy
Which changes pull you back in, how reassessment works across ISM releases, and how to plan your next assessment.
Common questions and live Q&A
Including the one everyone asks: "Will we be IRAP certified?" Bring your own questions for the panel.
Meet the Panel
Assessors stay independent of the systems they assess, so prep and assessment are done by separate firms. This panel brings both sides together.
Stutay Monga
Managing Director,
Schellman
The assessor's perspective
Virginia Suazo
VP of Cloud Security Advisory, 38North Security
Prep, scoping and readiness
Randy Holland
Technical Project Lead, 38North Security
FedRAMP to IRAP and the new ISM controls
Ingrid Woodley
Senior Director of Revenue Strategy, 38North Security
Moderator
