Certifications versus Assessments

An ASD-endorsed assessor ran the entire JFrog platform against the ISM at Protected level

IRAP produces a report rather than a certificate, so every Australian agency still makes its own Authority to Operate call. What has changed is the scope of what gets assessed: binary storage and model registries, not just the finished app.