We’re excited to announce that Box has completed an Information Security Registered Assessors Program (IRAP) assessment against the Australian Government’s security requirements and has been assessed at the PROTECTED authorization level.
This independent, government-recognized assessment demonstrates Box’s commitment to the rigorous security controls required to handle highly sensitive government information. With a mission to power how the world works together, Box helps over 10K government agencies (among its 120K customers) to fuel AI insights and protect unstructured data from one Intelligent Content Management platform
What is Intelligent Content Management?
Intelligent Content Management enables organizations to fuel collaboration, manage the entire content lifecycle, secure critical content, and transform business workflows with enterprise-grade AI. Founded in 2005, Box enables organizations worldwide, including 67% of the Fortune 500, to manage their content in one place.
Our platform goes far beyond simple file storage by offering intelligent content workflows, advanced data protection and compliance, enterprise-grade AI capabilities, and a flexible, interoperable ecosystem with 1,500+ integrations that help organizations unlock the full value of their unstructured data.
What IRAP PROTECTED Assessment means for your agency
In today’s heightened threat landscape, public sector agencies delivering essential services must protect themselves against disruptions that could compromise their mission. The IRAP Assessment establishes a rigorous security standard for cloud providers, giving agencies confidence in their technology choices. Box’s successful IRAP assessment delivers three critical advantages:
- Independent assurance through an accredited assessor’s objective report on Box’s technical controls, policies, and processes mapped to the Australian Information Security Manual
- Assessment for protected workloads covering highly sensitive government information where compromise could cause significant harm
- Faster procurement and reduced audit burden with validated evidence of critical security controls across all content stored in Box
PROTECTED classification, explained
The PROTECTED classification covers highly sensitive information where compromise could cause significant damage to national interests, individuals, or organizations. This requires robust security controls including advanced encryption, access management, monitoring, and rigorous process controls — all assessed in Box’s IRAP report. In general, PROTECTED status includes confidential government information, including information that is critical to a government entity's operations but is not classified as Secret or Top Secret. Its unauthorized release would cause serious harm.
Examples of workflows that could require PROTECTED status include:
- Federal investigations that require secure evidence management, analysis, and defensible audit trails
- Contract analysis across large libraries of sensitive data, while maintaining complete chain of custody and compliance documentation
- Eligibility assessment for benefits programs with full auditability
This IRAP assessment represents an important milestone for Box and for Australian public sector agencies looking to move sensitive content to a secure, managed Intelligent Content Management platform. It provides independent, government-recognized assurance at the PROTECTED level — helping agencies accelerate procurement, simplify audits, and lower security and compliance risk.
Peace of mind for you
Box combines powerful content management capabilities with enterprise-grade security features that have been rigorously assessed through the IRAP program. Our platform’s security architecture is specifically designed to secure government data at the PROTECTED level, giving agencies confidence that their sensitive information remains secure while still enabling modern collaboration and workflow automation:
- Advanced encryption protecting sensitive content at rest and in transit
- Robust access management with role-based controls ensuring only authorised personnel can access PROTECTED information
- Comprehensive logging and monitoring to detect and respond to potential security incidents
- Clear shared-responsibility model helping agencies design compliant architectures with confidence
"Box’s completion of an IRAP assessment at the PROTECTED level gives Australian and New Zealand agencies strong, independent assurance that Box’s platform – including its encryption, access management, logging and incident response controls – is engineered to handle highly sensitive government workloads," said Amy Machado, Senior Research Manager, Content and Knowledge Management Strategies, IDC.
Box’s completion of an IRAP assessment at the PROTECTED level gives Australian and New Zealand agencies strong, independent assurance that Box’s platform – including its encryption, access management, logging and incident response controls – is engineered to handle highly sensitive government workloads.
Benefits for Australian agencies
The IRAP Assessment unlocks significant advantages for government organizations looking to modernise their content management while maintaining the highest security standards. By choosing Box as your IRAP-Assessed platform, your agency gains immediate operational and compliance benefits that extend well beyond basic security requirements:
- Enhanced security posture with independently verified controls at the PROTECTED level
- Reduced operational and compliance risk through validation that minimizes uncertainty about configurations
- Procurement advantage with Box positioned effectively for government tenders and approvals
- Support for local data storage requirements when combined with appropriate region and configuration choices
- Streamlined vendor due diligence by referencing the IRAP assessment in compliance processes
This IRAP assessment is an important milestone for Box and for Australian public sector customers looking to move sensitive content to a secure and Intelligent Content Management platform. It provides independent, government-recognized assurance at the PROTECTED level — helping agencies accelerate procurement, simplify audits, and lower security and compliance risk.
