Kiteworks and A-LIGN extend IRAP data protection push in Australia

Kiteworks has extended its partnership with A-LIGN to give Australian public sector agencies and regulated enterprises access to an application-level IRAP PROTECTED assessment plus adjacent compliance frameworks. The move is meant to close a gap between vendor claims and independently verified controls across data protection, cloud security and AI governance.

Why it matters: - Australian agencies and regulated enterprises are under pressure to prove compliance across multiple frameworks, not just claim it. - The partnership is designed to give buyers independent evidence for IRAP plus adjacent requirements such as SOC 2, ISO 27001, ISO 42001, CMMC and FedRAMP. - The setup may reduce duplicate audits and shorten vendor-risk reviews for organizations that need proof across supply chains.

What happened: - Kiteworks extended its strategic partnership with A-LIGN to bring IRAP-aligned data protection to Australian government agencies and regulated enterprises. - The extension pairs the Kiteworks platform, which holds an application-level PROTECTED IRAP assessment, with A-LIGN’s independent assessment capabilities. - A-LIGN acquired AssurePoint, an Australian IRAP-specialist assessment firm, adding IRAP to its service portfolio and expanding its assessor capacity in Australia and Asia-Pacific. - Kiteworks and A-LIGN first announced their partnership in July 2026 for CMMC 2.0 Level 2 readiness in the U.S. defense industrial base.

The details: - Kiteworks has held an application-level IRAP assessment since 2022, and the most recent reassessment was completed in July 2026. - Existing assessment evidence may support control-specific inheritance, but that inheritance is not automatic. - A-LIGN validates the scope, currency and findings of the report, then assesses the customer’s configuration, integrations, shared responsibilities and residual risk. - A-LIGN’s assessment work covers IRAP alongside SOC 2, ISO 27001, ISO 42001 and CMMC. - A-LIGN does not provide consulting or remediation services in this model. - Kiteworks also holds a SOC 2 Type II report, is FedRAMP High In Process and Moderate Authorized, and holds ISO 27001, ISO 27017 and ISO 27018 certifications. - Kiteworks Compliant AI governs AI agent access to sensitive data. - The platform also offers FIPS 140-3 validated encryption, single-tenant deployment and sole ownership of encryption keys. - Kiteworks said these controls give assessors concrete, verifiable evidence to test. - Kiteworks said the application-level IRAP assessment is different from relying on a cloud host’s assessment alone.

Between the lines: - The release targets a common gap in government procurement: infrastructure-level assurances do not always cover the application layer where sensitive data is actually shared and governed. - A-LIGN’s no-consulting model is central to the pitch because it preserves assessor independence while also adding local Australian coverage. - The combined offer is meant to reduce the burden on organizations that otherwise have to coordinate separate auditors across overlapping frameworks.

What’s next: - Kiteworks and A-LIGN will host a session on Oct. 29, 2026 at 9:00 AM AEDT in Sydney. - The event will cover what an application-level IRAP PROTECTED assessment adds beyond infrastructure-only coverage and how A-LIGN’s assessment of a customer’s own environment fits alongside other frameworks. - Australian public sector and regulated-enterprise leaders in security, compliance and procurement are the intended audience. - Registration is available through the company’s announcement link.

The bottom line: - Kiteworks and A-LIGN are positioning an application-level, independently assessed compliance stack as a faster path for Australian buyers that need evidence, not promises.