Architecture  /  Azure Landing Zone
Azure Landing Zone · Deep dive 01

An assessable tenant in two weeks, not two quarters

IRAP at PROTECTED is a known path. Here is the opinionated Azure foundation that gets an agency to an assessable baseline fast, at a fixed price.

Draft outline · Delivery / procurement lens
The anchor

IRAP is the independent assessment of a system against the ISM, and PROTECTED is where most commercial assessments land. The ISM risk-management framework (define, select, implement, assess, authorise, monitor, drawn from NIST 800-37r2) is the path an accreditation walks. The differentiator is speed and price certainty, not novelty.

Sources we build on
Primary
ASD cyber.gov.au: IRAP

The authoritative government description of IRAP, its scope and the assessor program.

Primary
Microsoft Learn: Azure IRAP offering

Primary reference for what Azure already carries, so an agency inherits controls rather than rebuilding them.

Article outline
  1. What accreditation-ready means. An assessable baseline, not a finished accreditation.
  2. The opinionated foundation. Hub-spoke, policy-as-code, ISM-aligned defaults out of the box.
  3. Inheriting from the platform. What Azure's own IRAP posture gives you for free.
  4. The two-week shape. What we deploy, in what order, to get to assessable fast.
  5. Handing to the assessor. The evidence pack that makes the IRAP smoother.
How it aligns to what we do

A delivery-speed and procurement piece that embodies fixed-price, done-in-weeks. It speaks the assessor's and procurement officer's language and reframes the landing zone as time-to-assessable, the thing an agency actually buys.

Points to hit
Control it ratifies
ISM / E8 Implements the ISM risk-management framework end to end; the landing zone is the substrate the other Landing Zone dives build controls on.
← All deep dives Azure Landing Zone →