Our team has delivered at SECRET. That means we know what assessors look for, what controls actually matter, and how to build platforms that pass — not just ones that look like they should.
A structured four-phase methodology that embeds accreditation requirements into every stage of design, build and operations — so assessors receive complete, coherent packages, not retrospective documentation. Developed from real experience delivering at SECRET and PROTECTED.
Every document produced in formats IRAP assessors expect — no reformatting, no rewriting after design is complete.
Reusable, pre-assessed design patterns for common Defence capability types — drawing on real classified-environment experience.
ISM controls satisfied by platform and configuration choices — not addressed in documentation alone.
Programme had been in architecture phase for 9 months with no accreditation-ready artefacts produced.
Existing design used commercial-default configurations that failed ISM controls at PROTECTED.
No SSPS, no risk register, no authority artefacts — IRAP assessment couldn't commence.
Operational deadline was fixed — 6 months to accreditation or the programme would be descoped.
Redesigned cloud identity and endpoint posture against pre-validated, classified-environment-informed patterns in 6 weeks.
Complete IRAP artefact package — SSPS, risk register, control evidence and SoA — produced concurrently with design.
IRAP assessment commenced within 10 weeks. Zero findings requiring re-assessment.
Operational capability achieved within the fixed deadline.
Engage Northforge to scope your secure digital programme.