Organisations approaching federal work for the first time tend to encounter four acronyms at once and assume they need all of them. Usually they do not. This is a short orientation, not advice on your specific obligations.
The rough shape of each
- Essential Eight — a set of baseline mitigation strategies from the ACSC, with defined maturity levels. The most common starting point.
- ISM — the Information Security Manual, a comprehensive set of controls for government systems and those handling government information.
- IRAP — an assessment process, carried out by endorsed assessors, of a system against the ISM.
- DISP — the Defence Industry Security Program, membership-based, for organisations working with Defence.
Where the cost actually sits
The assessment is rarely the expensive part. The expensive part is the remediation work the assessment identifies, and the ongoing evidence-keeping that demonstrates the controls still operate months later.
Compliance is not a project with an end date. It is a standard of operation you either sustain or quietly lapse from.
A sensible order
For most organisations, working honestly towards Essential Eight maturity is the right first step regardless of which framework eventually applies. The controls it covers are the ones that prevent the incidents that actually happen, and the evidence you build is reusable when a formal assessment arrives.
If you are responding to a tender and unsure which obligations attach to it, we can help you read the requirement before you commit to a scope of work.