Third Time, Higher Bar: Celebrating Our Latest IRAP PROTECTED Milestone
What does it take to be independently assessed against the Australian Signals Directorate Information Security Manual? Ask our team. They’ve just done it for the third time.
Some milestones arrive quietly. This isn’t one of them.
Over August and September 2026, our team completed Kapish’s third IRAP assessment of our Platinum and Gold+ versions of Content Manager Cloud. The assessment was conducted at the PROTECTED level once again, this time against the June 2026 Information Security Manual (ISM), containing 1,100 controls. This version of the ISM introduced approximately 250 new controls and updated a further 350 controls compared to our previous assessment.
That’s not just a bigger number. It’s a higher bar, and our team rose to meet it.
For government agencies, critical infrastructure operators and other highly regulated organisations, independent security assurance is increasingly important when selecting technology partners. So I want to share why this achievement matters, both for Kapish and for the organisations we work with.
Here are three reasons this milestone is worth celebrating:
1. The Bar Has Never Been Higher
Security standards don’t stand still. ASD updates the ISM regularly as threats evolve and technology changes, with those updates reflecting the evolving cyber security landscape and security practices.
Our first IRAP assessment set the foundation. Our second built on it. This third assessment was our most comprehensive yet: 1,100 controls against the June 2026 ISM, with approximately 600 new or updated controls compared to the previous assessment.
Every assessment is a snapshot in time. Choosing to be assessed again against a more demanding standard and a growing list of controls is what turns a one-off achievement into an ongoing commitment. This assessment reflects the continuous evolution of our security posture to meet an increasingly sophisticated threat landscape.
The result? Content Manager Cloud has now been independently assessed against more controls than ever before.
2. Independent Assessment, Not Just a Promise
Any provider can say their platform is secure. An IRAP assessment means an independent ASD-endorsed assessor has evaluated it against the controls outlined in the ISM.
IRAP assessors review the policies, plans, processes and procedures that support a service, along with how those controls are implemented and maintained in practice.
The assessment found that Kapish had identified the applicable PROTECTED controls for Content Manager Cloud and had developed policies, plans, processes and procedures designed to protect the information processed and stored within the platform. The assessment also recognised the strong commitment to information security demonstrated by our team throughout the process.
Independent assessment matters because it provides organisations with greater transparency into a platform’s security posture, helping them make informed decisions when evaluating technology solutions.
3. Supporting Government and Highly Regulated Organisations
For Australian Government agencies, adopting a cloud service means granting it an Authority to Operate (ATO). The assessment found no impediment to agencies granting Content Manager Cloud an ATO at the PROTECTED security classification. Agencies still complete their own due diligence and fulfil their documented consumer responsibilities, but the assessment provides valuable independent assurance as part of that process.
And it doesn’t stop at government. Independent assessment against the PROTECTED controls of the June 2026 ISM can provide valuable assurance for critical infrastructure operators and other highly regulated organisations seeking confidence in the security posture of the platforms they rely on.
Content Manager Cloud is hosted in Microsoft Azure within Australia, providing government agencies, critical infrastructure organisations and other regulated entities with an onshore environment designed to securely manage records and information.
A Milestone That Belongs to Our Team
I didn’t complete this assessment, but I’ve had a front-row seat to the people who did.
Our Head of Product and Development, Kurt Wieprecht, along with our Cyber Security, Cloud Operations and Service Delivery teams, plus everyone else across Kapish who gathered evidence, answered questions and refined our processes, made this happen. Working through 1,100 controls takes discipline, attention to detail and a shared belief that security is everyone’s responsibility.
In my experience, the organisations we work with don’t just want a capable records platform. They want a partner they can trust with their most sensitive information. This achievement demonstrates, once again, the seriousness with which our team takes that trust. I couldn’t be prouder of them.
The Bigger Question
The real question isn’t whether your records platform works. It’s whether it has been independently assessed against a rigorous security framework designed to protect the information your organisation, and the community it serves, depends on.
For Content Manager Cloud, that answer just got stronger. For the third time.
About the Author
Stewart Hollingdrake is Head of Business Development at Kapish, working with organisations across Australia and New Zealand to find the right information management solutions for their needs.
Want to Know What IRAP PROTECTED Means for Your Organisation?
Contact the Kapish team to learn how Content Manager Cloud can help support your security, compliance and information management objectives with confidence.
