Cellebrite seeks IRAP review for Guardian cloud tool

Cellebrite has put its Guardian digital evidence management platform forward for assessment under the Australian government's Infosec Registered Assessors Program (IRAP).

The review will be carried out by CyberCX, an assessor endorsed by the Australian Signals Directorate, with work scheduled to start in the first half of 2026.

The move comes as Australian law enforcement, defence and national security organisations weigh cloud services for investigative work while operating under strict security requirements. Agencies often require independent security assurance before starting internal authorisation processes for cloud platforms.

IRAP process

IRAP is administered by the Australian Signals Directorate through the Australian Cyber Security Centre. It provides a framework for independent assessors to evaluate security controls against two Australian government standards: the Information Security Manual and the Protective Security Policy Framework.

The programme does not issue certifications or accreditations. Instead, it produces assessment documentation that agencies use to inform their own risk decisions and approvals.

Cellebrite said it is not seeking government endorsement through IRAP. It described the assessment as a step toward the independent scrutiny agencies typically require when evaluating cloud platforms that handle sensitive data.

Evidence workflows

Guardian is a cloud-based platform for managing digital evidence across investigative and prosecutorial workflows. It sits between forensic extraction and downstream review, analysis and case preparation.

Digital evidence volumes in Australia continue to rise. Investigations increasingly involve data from smartphones, cloud services, messaging apps and connected devices. Agencies say this growth can strain forensic labs and slow review processes, and can make collaboration harder when evidence and analysis are fragmented across multiple systems.

Cellebrite said Guardian is designed to reduce bottlenecks associated with on-premise systems and siloed infrastructure. The company positioned it as a way for teams to manage, review and collaborate on evidence while maintaining integrity controls.

Sovereignty questions

Cloud adoption in government investigations often raises questions about jurisdiction and where sensitive information is stored and processed. Australian agencies frequently require clear controls over data residency, access permissions and audit trails.

Cellebrite said Guardian supports deployment models intended to align with Australian government expectations for handling sensitive investigative data. It cited access controls and audit logging as core platform elements, along with evidence integrity protections and chain-of-custody tracking.

These controls matter because investigative teams handle material that may later be tested in court. They also help agencies demonstrate compliance with security rules and internal governance requirements when using third-party systems.

Scope and outputs

CyberCX completed an Information Security Manual gap assessment for Guardian in December 2025, according to Cellebrite. That work identified how the platform's controls compared with the manual's baseline requirements.

The full IRAP assessment is expected to begin in early 2026 and follow the Australian Cyber Security Centre's Cloud Security Assessment and Authorisation Framework.

Cellebrite said the assessment will produce three main deliverables: a Cloud Controls Matrix documenting control coverage, a Cloud Security Assessment Report evaluating control effectiveness, and recommendations to strengthen implementation.

Organisations commonly use these documents as inputs to internal assessments. Each agency still makes its own authorisation decision, even when an IRAP assessment is available.

Agency evaluation

Cellebrite said agencies often begin evaluating cloud platforms while security reviews are still under way. It plans to provide security architecture documentation, data-handling information and guidance to support agency assessments, and expects auditability and chain-of-custody protections to be closely examined.

CyberCX is one of the larger IRAP assessment providers in Australia. Cellebrite said it selected CyberCX for its cloud assessment experience and familiarity with the Information Security Manual and the Protective Security Policy Framework.

According to the company, the commitment reflects a longer-term investment in Australia and a strategy of aligning products with local regulatory and security expectations rather than applying a standard approach across markets.