IRAP-assessed secure email for
Australian Government agencies and contractors
The only commercial email platform with an IRAP assessment at OFFICIAL: Sensitive level — purpose-built for Australian Government agencies, contractors, and organisations handling classified information.
IRAP requirement: Commonwealth and state government procurement increasingly mandates IRAP assessment of all cloud services handling government information. Non-IRAP-assessed email providers cannot be used for OFFICIAL: Sensitive information regardless of brand recognition.
Government email compliance in Australia
Every compliance obligation that applies to government email — and how ShieldBox satisfies each one.
ASD-administered IRAP assessment is the primary mechanism for assuring government ICT security. ShieldBox holds a current IRAP assessment covering OFFICIAL and OFFICIAL: Sensitive classification levels for all email infrastructure.
The PSPF mandates how Commonwealth entities protect official and sensitive information including email. Australian data residency is a PSPF requirement for all OFFICIAL: Sensitive and above communications.
The ASD ISM specifies technical controls for Australian Government email — DMARC enforcement, AES-256 encryption, TLS 1.2+, MFA for all access, 7-year audit log retention, and IRAP-assessed infrastructure.
Essential Eight Maturity Level 2 is the standard baseline for most government agencies and contractors. ShieldBox is verified at ML2 with a pathway to ML3 for agencies requiring the highest assurance level.
Everything government needs
Built from the ground up for Australian compliance requirements specific to government.
Current ASD-administered IRAP assessment covering email at OFFICIAL and OFFICIAL: Sensitive levels. Assessment documentation available same-day for procurement.
All data stored in Sydney primary and Melbourne DR data centres. Zero offshore processing or storage — satisfying PSPF data sovereignty requirements.
FIDO2/passkey hardware security key support for ML3. Authenticator app MFA standard for all accounts. SMS MFA blocked by policy.
Complete email audit trail retained for 7 years. Tamper-proof WORM storage. Accessible for ANAO reviews, Senate estimates, and FOI responses.
Full ISM-0272 compliance — DMARC at p=reject, DKIM signing, and SPF enforcement for all domains. Eliminates domain spoofing for government communications.
Configurable email classification labels (OFFICIAL, OFFICIAL: Sensitive) that appear in email subjects and are enforced by data loss prevention rules.
Every government setting, covered
Non-corporate Commonwealth entities migrating from legacy on-premises email to PSPF and ISM compliant cloud infrastructure.
Get startedNSW, VIC, QLD, WA, SA, TAS, ACT, and NT government agencies with state-specific information security policy requirements.
Get startedConsultancies, IT service providers, and professional services firms on government panels requiring IRAP-assessed email infrastructure.
Get startedOrganisations supporting the ADF, ASIO, ASIS, and defence agencies with requirements beyond OFFICIAL: Sensitive.
Get startedTrusted by Australian government professionals
“Procurement required demonstrated IRAP assessment before we could be approved as a panel supplier. ShieldBox was on the approved list and provided assessment documentation same day. We won the contract.”
“We migrated three state agency email systems to ShieldBox in 90 days. The PSPF-aligned classification labels and IRAP documentation satisfied the state government's ICT security review without a single finding.”
Our team migrates your complete email history from Gmail, Outlook, or any provider. Overnight, zero downtime.
Government email FAQ
ShieldBox holds a current IRAP assessment at OFFICIAL and OFFICIAL: Sensitive levels. For agencies requiring PROTECTED-level email, ShieldBox operates a separately assessed PROTECTED platform — contact our government team at gov@shieldbox.com.au.
Ready to protect your government practice?
Join thousands of Australian government professionals on the only email platform purpose-built for Australian compliance. Free 30-day trial, no credit card required.