This article is based on a case study originally co-authored by Rohit Kumar Cherukuri, Vice President – Marketing, Cloud4C, and published on azure.microsoft.com.
Background: IRAP and Australian Government Cloud Requirements
Australian government agencies handling sensitive data must comply with the Australian Government Information Security Manual (ISM), produced by the Australian Signals Directorate (ASD). A key part of this framework is the Information Security Registered Assessors Program (IRAP), an ASD initiative that endorses qualified ICT security professionals to assess and validate the security posture of cloud and ICT environments used to process, store, and transmit government data.
IRAP assessments are required for cloud environments operating at the PROTECTED classification level — the threshold at which government data is considered sensitive enough to require rigorous, independently verified security controls.
In April 2018, the Australian Cyber Security Centre (ACSC) certified Microsoft Azure and Office 365 at the PROTECTED classification, making Microsoft the first public cloud provider to achieve this designation. This certification covered specific Azure data centres in Australia, including Australia Central and Australia Central 2, both of which underwent stringent IRAP physical security assessments.
The Business Challenge
One of Australia’s largest federal agencies — responsible for managing and maintaining national finances — needed to migrate its SAP landscape to a cloud environment that met IRAP PROTECTED requirements. The agency required a Platform as a Service (PaaS) model capable of handling classified information in full compliance with the ISM’s security objectives across three critical domains:
- Physical security – certified data centre facilities
- Infrastructure security – network, compute, and storage controls
- Managed services security – operational processes up to the SAP basis layer
Cloud4C, an Azure Expert Managed Service Provider (MSP), took on the engagement and partnered with Microsoft to deliver a compliant SAP environment on Azure.
Solution Overview
The engagement scope covered configuring and managing the SAP landscape on Azure with managed services up to the SAP basis layer, while maintaining IRAP PROTECTED classification standards. SAP application managed services above the basis layer were outside the engagement scope. Cloud4C structured its assessment approach across three distinct categories — physical, infrastructure, and managed services — to align with the IRAP control framework.
SAP Workloads and Architecture
The solution covered a broad SAP landscape including:
- SAP ERP, SAP BW, SAP CRM, SAP GRC, SAP IDM, SAP Portal, SAP Solution Manager, Web Dispatcher, and Cloud Connector
- Databases: SAP HANA, SAP MaxDB, and legacy Sybase databases
Azure Australia Central served as the primary region, with Australia Central 2 as the secondary disaster recovery (DR) region. Both regions had already undergone IRAP assessments for physical security, giving Cloud4C a significant head start on meeting physical controls.
The architecture incorporated the following design elements:
- Certified Azure Virtual Machine SKUs validated for SAP workloads
- Optimised storage and disk configuration
- Appropriate network SKUs with layered protection
- High availability and disaster recovery mechanisms
- Backup and monitoring tooling
- A mix of native Azure and Azure Marketplace security tools
- Defined service delivery processes and operational guidelines
Azure Services Used
The following Azure services formed the core of the IRAP-compliant architecture:
- Azure Availability Sets
- Azure Active Directory
- Azure Privileged Identity Management
- Azure Multi-Factor Authentication
- Azure ExpressRoute gateway
- Azure Application Gateway with Web Application Firewall (WAF)
- Azure Load Balancer
- Azure Monitor
- Azure Resource Manager
- Azure Security Center
- Azure Storage and Disk Encryption
- Azure DDoS Protection
- Azure Virtual Machines (SAP-certified SKUs for SAP applications and SAP HANA)
- Azure Virtual Network
- Azure Network Watcher
- Network Security Groups (NSGs)
IRAP Compliance and Assessment Process
Cloud4C worked alongside an accredited IRAP assessor to navigate the compliance framework. The assessor evaluated the implementation, appropriateness, and effectiveness of security controls across the system. The ISM mandates a two-stage security assessment process:
- Stage 1: Identifies security deficiencies that the system owner must rectify or mitigate before proceeding.
- Stage 2: Assesses residual compliance after mitigations have been applied.
Because Azure infrastructure had already achieved IRAP certification at the data centre level, Cloud4C could focus its efforts on the remaining controls applicable to the cloud managed services layer. In total, Cloud4C’s IRAP assessment addressed 412 high-risk controls and 19 critical security aspects distributed across 22 major control categories — after subtracting controls already covered by Azure’s certified infrastructure and DR capabilities.
Key activities carried out during the assessment included:
- Designing end-to-end system architecture incorporating all components and communication stakeholders
- Mapping security controls against Australian government security policy
- Confirming that Australia Central and Australia Central 2 data centres met IRAP physical security requirements
- Implementing ISM security controls across infrastructure and managed services layers
- Defining mitigation strategies for any identified non-compliance
- Identifying system risks and documenting mitigation approaches
Microsoft’s solution architects and engineering team contributed by sharing best practices for leveraging Azure native tools, advising on third-party security tool integration, and participating in architecture design reviews.
Automation and Deployment Efficiency
Two automation strategies were critical to the delivery timeline:
- ARM Template Deployment: Azure Resource Manager (ARM) templates were used to deploy a large landscape of more than 100 virtual machines and 10 SAP solutions in under one month.
- Robotic Process Automation (RPA): RPA tooling was applied to identify and manage business-as-usual processes within the SAP ecosystem, reducing disruption to live business operations while automation handled infrastructure-level availability management.
Key Technical Learnings
Several important technical insights emerged from the engagement that are relevant to any team planning an IRAP-compliant SAP deployment on Azure:
- Sub-millisecond inter-region latency: Australia Central and Australia Central 2 are connected via fibre links offering sub-millisecond latency. This enabled SAP HANA database replication in synchronous mode, achieving a zero Recovery Point Objective (RPO) for disaster recovery.
- Azure Active Directory Domain Services availability gap: At the time of the engagement, Azure Active Directory Domain Services were not available in the Australia Central region. The team used the Azure South-East Asia region as a workaround to ensure seamless identity services delivery.
- Azure Site Recovery for SAP MaxDB: Azure Site Recovery was successfully used for replication of the SAP MaxDB database, demonstrating its applicability beyond common operating system workloads.
- ExpressRoute traffic encryption: ExpressRoute traffic is not encrypted by default at the Azure platform level. To meet IRAP PROTECTED requirements, a network virtual appliance (NVA) from a Microsoft security partner was deployed to encrypt traffic traversing the ExpressRoute circuit.
Outcomes
Cloud4C completed the full IRAP assessment process in approximately 9 months, compared to what the article describes as an industry norm of 1–2 years. The key factors enabling this accelerated timeline were:
- Starting from Azure’s pre-existing PROTECTED-level certification for infrastructure and physical controls
- Leveraging prior multi-region and industry compliance experience on Azure
- Using ARM templates and automation tooling to compress the deployment timeline
- Deep collaboration with Microsoft’s solution architects throughout the design and assessment phases
The engagement resulted in a successfully assessed, IRAP PROTECTED-compliant SAP environment running on Azure for a large Australian federal agency, covering infrastructure, disaster recovery, managed services, and SAP basis operations under a single service level agreement.
Summary: What This Means for DevOps and Cloud Teams
This case demonstrates a practical path for Australian government and regulated-sector teams looking to run complex enterprise workloads — particularly SAP — in a PROTECTED-classified cloud environment. The key takeaways for practitioners are:
- Understand the shared responsibility model clearly: Azure’s IRAP certification covers physical and infrastructure controls, but cloud service provider and managed service provider controls still require independent assessment.
- Map your Azure services selection directly to ISM control requirements early in the design phase.
- Plan for regional service availability gaps — not all Azure services are available in sovereignty-focused regions like Australia Central.
- Address ExpressRoute encryption explicitly — it is not enabled by default and may be required by IRAP controls.
- Use infrastructure-as-code (ARM templates or equivalent) aggressively to achieve deployment speed without sacrificing compliance documentation.
- Engage an accredited IRAP assessor early, and treat the two-stage ISM assessment process as a structured project phase rather than an afterthought.