Kiteworks and compliance assessment firm A-LIGN have extended their partnership to target Australian government agencies and regulated enterprises seeking IRAP-aligned assurance for data protection platforms.
The companies said the arrangement combines Kiteworks’ application-level IRAP assessment at the PROTECTED classification with A-LIGN’s assessment services across IRAP and other assurance frameworks commonly requested in supply-chain and vendor risk reviews.
The announcement comes as Australian public sector agencies and regulated organisations face increasing scrutiny over whether technology vendors can provide evidence of controls at the application layer, rather than relying solely on an IRAP assessment of an underlying cloud hosting environment.
The partners said Kiteworks has held an application-level IRAP PROTECTED assessment since 2022, with a reassessment completed in July 2026. Under the extended partnership, A-LIGN assessors will review the scope and currency of the existing assessment material and evaluate customer-specific configuration, integrations, shared responsibility boundaries and residual risk. The companies said evidence from prior assessments may be used for control-specific inheritance, but that inheritance is not automatic.
A-LIGN said its model is assessment-only and does not include consulting or remediation services, which it said is intended to preserve assessor independence.
The extension follows A-LIGN’s acquisition of AssurePoint, an Australian IRAP specialist assessment firm. The companies said the acquisition expands A-LIGN’s IRAP capability and assessor capacity in Australia and the broader Asia-Pacific region, alongside services it provides for SOC 2 and ISO 27001.
Kiteworks said its broader assurance portfolio includes a SOC 2 Type II report, FedRAMP Moderate Authorised status and a FedRAMP High “In Process” designation, as well as ISO 27001, ISO 27017 and ISO 27018 certifications.
“Being IRAP assessed at the application level, not just inheriting a cloud host’s status, is the difference between telling a customer ‘we’re covered’ and showing them the report,” said Kieran O’Shaughnessy, General Manager, APAC, Kiteworks. “Extending our work with A-LIGN into the Australian market gives our customers one relationship that produces independent evidence across IRAP and every adjacent framework their own customers ask about.”
“Our acquisition of AssurePoint gives A-LIGN a materially larger presence on the ground in Australia, right as organizations there are being asked to prove compliance across more frameworks than ever, often to different auditors who never talk to each other,” said Nick Ludy, Chief Growth Officer, A-LIGN. “Pairing that expanded regional reach with a platform that already holds its own IRAP PROTECTED assessment lets us close the gap for organizations without asking them to manage it themselves.”
