Three patterns that delay an IRAP Stage 2

Stage 2 of an IRAP engagement rarely slips because the technology is wrong; it slips because the evidence isn’t where the assessor expects it.

The Stage 1 design review hands the system owner a clear set of findings. Stage 2 is where the assessor walks the controls against the running system. The duration of Stage 2 — and the temperature of the report — is set in the first two weeks. After that, the rest is process. Three patterns predict most of the slippage we see in the PROTECTED-ceiling work TrustedZone’s Director assesses against.

Pattern 1 — Evidence collected at the wrong altitude. The system owner sends architecture diagrams. The assessor needs configuration. The system owner sends a security policy. The assessor needs the IAM export that shows the policy applied. The altitude mismatch is almost always upward: the team has documented intent, not state. The remedy is cheap if caught early — a one-page evidence-altitude rubric shared at Stage 1 closeout, with three examples of “this counts, this doesn’t” per control family. Caught late, the same gap takes a full re-collection cycle and a second walkthrough.

Pattern 2 — Inherited controls without provenance. A cloud-tenanted system inherits half its controls from the underlying platform. Inheritance is legitimate; bald inheritance assertions are not. When an Annex A row reads “inherited from [provider]” with no pointer to the provider’s IRAP report date, the underlying control name on the provider’s side, and the customer-side responsibility, the assessor must treat the row as undocumented. Provenance turns a one-day clarification into a one-line citation. Its absence turns it into a chain of emails across two organisations and a calendar week.

Pattern 3 — A single contact for everything. A small team appoints one person as the assessor’s interface. That person becomes the bottleneck. Every clarification — networking, IAM, logging, vendor-management, HR offboarding — routes through them, and the assessor’s questions queue. The fix is structural, not behavioural: publish a named contact per control family before Stage 2 begins, with explicit backup. The assessor doesn’t need a single point of contact; the assessor needs a routing table. The fastest Stage 2s look like a short stand-up each morning with the right specialist already in the room for that day’s controls.

None of these patterns is a control failure. They are organisation patterns that show up as control failures in the final report, because the assessor can only write what was demonstrable in the window. A control that is fully implemented but undocumented at the moment of assessment is, for IRAP purposes, partially implemented.

Takeaway. Before Stage 2 kickoff, publish three things: an evidence rubric, an inheritance provenance template, and a control-family contact map. The total cost is half a day. The saving is measured in weeks.

Published by TrustedZone news automation on 2026-05-17 AEST. Director rollback.