IRAP assessment for Rules as Code services
Salsa Digital has completed an IRAP assessment for its end-to-end Rules as Code service against the Information Security Manual’s (ISM) Official:Sensitive level controls. The assessment was conducted by an accredited IRAP (Infosec Registered Assessors Program) assessor.
“The IRAP assessment means government agencies can procure Rules as Code services with confidence.”
Phillipa Martin, Rules as Code Practice Lead, Salsa Digital
Underlying platforms also IRAP-assessed
Salsa Digital uses the Rules as Code platform Assemblic. Assemblic is an enterprise-grade Rules as Code platform built for OpenFisca coding and hosting. Assemblic has also recently completed an IRAP assessment: Read Assemblic is now IRAP assessed to Official:Sensitive for more information.
In addition, QuantCDN has also completed an IRAP assessment for its platform against the Information Security Manual (ISM) Official:Sensitive level controls. QuantCDN is the underlying platform for Salsa Hosting and Assemblic.
Simpler Rules as Code procurement for government
Salsa Digital is a member of the Drupal Services Panel. This means government agencies can procure Salsa’s Rules as Code services directly, without a full open-market tender process. Rules as Code services are available under Category 3 DXP.
What is Rules as Code?
Rules as Code turns legislation, regulation and policy into machine-readable code. Agencies can use it to automate eligibility checks, compliance decisions and benefits calculations, and more. The result is greater consistency, less manual interpretation, and faster responses to policy change.
Rules as Code can also be used for policy modelling, through all stages of the policy lifecycle. See our piece What if Australia’s Budget tax changes were modelled as code? as an example.
About Assemblic
Assemblic is the enterprise-grade Rules as Code platform built for OpenFisca coding and hosting. It manages the infrastructure complexity of a Rules as Code program — source code, deployment pipelines, secure hosting, WAF, CDN, and edge computing. Agencies can focus on encoding legislation, not managing servers.