Kiteworks, which empowers organizations to effectively manage risk in every send, share, receive, and use of private data, has expanded its strategic partnership with A-LIGN, a leading global cybersecurity compliance and assessment firm. The expanded collaboration will bring IRAP-aligned data protection to Australian government agencies and regulated enterprises while addressing the broader assurance requirements of their global supply chains.
Australian public sector agencies and regulated enterprises increasingly need verifiable evidence that their technology vendors meet security and compliance requirements, rather than relying solely on vendor claims. Many vendors serving the Australian government can demonstrate that their cloud hosting providers have undergone IRAP assessments, but lack an equivalent assessment of the applications themselves. This application layer is where sensitive data is shared, governed, and exchanged.
The expanded partnership builds on the collaboration Kiteworks and A-LIGN announced in July 2026 to support CMMC 2.0 Level 2 readiness across the U.S. defense industrial base. It also follows A-LIGN’s acquisition of AssurePoint, an Australian IRAP-specialist assessment firm. The acquisition adds IRAP to A-LIGN’s existing service portfolio, which includes SOC 2 and ISO 27001, while strengthening its assessment capacity and local presence across Australia and the wider Asia-Pacific region.
Through the expanded partnership, organizations using the Kiteworks platform can begin with an application that has already undergone independent assessment against PROTECTED-level IRAP controls, rather than relying on a future commitment to achieve compliance. Kiteworks has maintained this application-level assessment since 2022, with its latest reassessment completed in July 2026. Existing assessment evidence may support control-specific inheritance and reduce duplicated assessment work, although inheritance is not automatic. A-LIGN’s assessors independently verify the report’s scope, currency, and findings before evaluating the customer’s configuration, integrations, shared responsibilities, and residual risk. The assessment process can also address SOC 2, ISO 27001, ISO 42001, and CMMC requirements without introducing consulting or remediation services that could compromise A-LIGN’s independence.
Kiteworks maintains an extensive portfolio of independent assurance credentials. The platform holds a SOC 2 Type II report, is FedRAMP High In Process and Moderate Authorized, and maintains ISO 27001, 27017, and 27018 certifications covering security, cloud security, and privacy, respectively. Kiteworks Compliant AI also governs AI agent access to sensitive data, an area addressed by ISO 42001. Additional platform capabilities include FIPS 140-3 validated encryption, single-tenant deployment, and sole ownership of encryption keys. These certifications and security controls give independent assessors such as A-LIGN verifiable evidence to evaluate, rather than relying on policy documentation that describes intended practices.
“Being IRAP assessed at the application level, not just inheriting a cloud host’s status, is the difference between telling a customer ‘we’re covered’ and showing them the report,” said Kieran O’Shaughnessy, General Manager, APAC, Kiteworks. “Extending our work with A-LIGN into the Australian market gives our customers one relationship that produces independent evidence across IRAP and every adjacent framework their own customers ask about.”
A-LIGN’s independent, assessment-only approach is a central component of the partnership. By avoiding consulting and remediation services that could undermine its objectivity, the firm maintains independence when assessing organizations pursuing IRAP, CMMC, and related compliance frameworks. A-LIGN is extending this model directly to Australian organizations through its own locally based IRAP assessment capabilities, alongside assessments for the additional frameworks commonly required during vendor-risk reviews. This enables Australian buyers to access these assessment services through a single provider rather than having to seek support from other firms.
“Our acquisition of AssurePoint gives A-LIGN a materially larger presence on the ground in Australia, right as organizations there are being asked to prove compliance across more frameworks than ever, often to different auditors who never talk to each other,” said Nick Ludy, Chief Growth Officer, A-LIGN. “Pairing that expanded regional reach with a platform that already holds its own IRAP PROTECTED assessment lets us close the gap for organizations without asking them to manage it themselves.”
Kiteworks and A-LIGN will host a webinar on October 29, 2026, at 9:00 AM AEDT (Sydney time), examining the value of application-level IRAP PROTECTED assessments beyond infrastructure-only coverage. The session will explain how Kiteworks’ assessment, maintained since 2022 and most recently reassessed in July 2026, complements A-LIGN’s independent assessment of each customer’s environment.
The webinar will also explore how organizations can address IRAP alongside SOC 2, ISO, and FedRAMP assessments that may already form part of their compliance programs. The session is intended for Australian public sector and regulated-enterprise leaders responsible for security, compliance, and procurement. Register here.
Kiteworks’ mission is to empower organizations to effectively manage risk in every send, share, receive, and use of private data. The Kiteworks platform provides customers with a secure data exchange that delivers data governance, compliance, and protection in a unified control plane. Kiteworks unifies, tracks, controls, and secures sensitive data moving within, into, and out of their organization, significantly improving risk management and ensuring regulatory compliance on all private data exchanges. Headquartered in Silicon Valley, Kiteworks protects over 100 million end-users and thousands of global enterprises and government agencies.
A-LIGN is the leading cybersecurity compliance partner, trusted by over 6,400 organizations worldwide to navigate the complexities of compliance, audit, and risk. With a tech-enabled delivery model and deep domain expertise, A-LIGN has completed more than 36,000 audits. It is the #1 issuer of SOC 2 reports and a top three FedRAMP assessor. Founded in 2009, A-LIGN delivers high-quality, efficient audits across frameworks including IRAP, SOC 2, ISO 27001, FedRAMP, CMMC, ISO 42001, PCI, and HITRUST.
Media Contact: David Schutzman, Kiteworks, 203-550-8551, david.schutzman@kiteworks.com
