Smartsheet wins Australian IRAP security assessment

Smartsheet has completed an Information Security Registered Assessors Program assessment at the OFFICIAL: Sensitive classification level against Australian government security requirements.

Cybersecurity firm Sekuro conducted the review against the Australian Government Information Security Manual. Smartsheet said the result validates its security and governance model for handling sensitive data used by government agencies and regulated organisations in Australia.

IRAP is used by Australian public sector bodies and suppliers as a benchmark for assessing whether technology systems align with government security controls. Reaching the OFFICIAL: Sensitive level is relevant for organisations that handle information requiring tighter safeguards than standard official data.

Smartsheet said the assessment could support procurement, risk assessment and vendor review processes for customers in government and regulated sectors. The company provides work management software used to plan programmes, track work, automate processes and monitor progress across teams.

The milestone also builds on a broader local infrastructure push. Last year, Smartsheet introduced Smartsheet Regions Australia, a data residency option hosted in Sydney with backup infrastructure in Melbourne, allowing customers to keep data within Australia.

The arrangement is intended to help customers meet local privacy requirements, including the Australian Privacy Act, while giving them greater control over where information is stored. Data location has become a central issue for many public sector buyers and regulated industries when selecting software providers.

Jarrod Kinchington, Vice President and General Manager, APAC, Smartsheet, said the company sees trust as a threshold issue for adoption in government and tightly regulated markets.

"For Australian government agencies and highly regulated organisations, adopting new technology starts with proving it can be trusted with sensitive data," said Kinchington. "IRAP gives them that proof, backed by an independent assessment. It also points to something bigger: we built our platform to be trustworthy from the ground up, so government agencies and enterprises can run their most critical work on Smartsheet, and scale AI, without compromising security or control."

Alongside the IRAP result, Smartsheet pointed to a broader compliance framework that includes SOC 2 Type II, ISO 27001, ISO/IEC 27701, ISO 27017 and ISO 22301. It also said it recently achieved ISO 42001 certification, which covers AI management systems.

Those certifications come as software providers face closer scrutiny over how they govern data, user permissions and AI-based features. Vendors selling into government and highly regulated sectors are increasingly expected to provide third-party evidence that systems meet security, privacy and operational resilience requirements.

Smartsheet said its platform includes a least-privilege permission model and encryption for data in transit and at rest. It has also been expanding its position on AI use in workplace software, arguing that governance controls need to keep pace as organisations deploy AI tools alongside staff.

Linus Lai, Group Vice President and Chief Analyst, ANZ, IDC, said external assessments can reduce friction in technology buying decisions.

"Independent validations such as IRAP give government agencies and regulated organisations greater confidence in a platform's ability to meet security and compliance requirements," said Lai. "When combined with data residency and enterprise-grade governance, they can help reduce adoption barriers and support faster digital transformation."

Smartsheet is used by millions of people and says its customer base includes most of the Fortune 500.