What is the expected timeline for converting the certification into actual sales or contracts within Australian government agencies?

Short answer:

The press release does not disclose a concrete, publicly‑announced timetable for when the “Protected”‑level IRAP certification will translate into sales or contract wins with Australian government agencies. CyberArk’s announcement is focused on the successful completion of the assessment itself, not on a specific rollout schedule.

Why the timeline isn’t specified in the release

Because the release is a product‑validation announcement rather than a sales‑pipeline update, it intentionally leaves the conversion timeline open.

What typically drives the conversion timeline for a new IRAP certification in Australia

1. Government procurement cycles – Australian federal and state agencies usually follow a annual budgeting and procurement calendar:
   • Q1 (Feb–Mar): Budget approvals and strategic planning.
   • Q2 (Apr–Jun): Publication of “Request for Information” (RFI) and “Request for Proposal” (RFP) documents.
   • Q3 (Jul–Sep): Evaluation of proposals, short‑listing, and pilot‑program negotiations.
   • Q4 (Oct–Dec): Contract award, onboarding, and initial deployment.

If CyberArk’s IRAP certification is newly recognized, the earliest realistic window for a first government contract would therefore be *mid‑2025 to early‑2026*, assuming agencies issue relevant RFPs in the Q2–Q3 window of the fiscal year that follows the certification announcement (i.e., FY 2025‑26, which runs 1 July 2025 – 30 June 2026).

1. Agency‑specific security‑by‑design mandates – Certain high‑impact agencies (e.g., the Department of Defence, Australian Taxation Office, and state health departments) have mandatory security‑by‑design requirements that explicitly reference “IRAP‑Protected” solutions. Once a solution meets that threshold, agencies can:

   • Fast‑track it through existing “Approved Solution” lists.
   • Accelerate procurement via “single‑source” or “direct award” mechanisms, which can cut the timeline to 3–6 months after the agency’s internal approval.

2. Pilot and proof‑of‑concept (PoC) phases – Even with a certification, many agencies will first run a PoC to validate integration with legacy systems (e.g., SAP, Microsoft 365, or custom government applications). Typical PoC durations in the Australian public sector are 4–8 weeks, followed by a risk‑assessment review that can add another 2–4 weeks before a full‑scale contract is signed.

3. Contracting frameworks – Australia’s Commonwealth Procurement Rules (CPR) and the Digital Marketplace (formerly Aus‑Gov Marketplace) provide pre‑negotiated contract vehicles (e.g., “Enterprise Agreements”). If CyberArk registers its SaaS offering on the Digital Marketplace soon after the IRAP announcement, agencies can procure under an “off‑the‑shelf” framework within 30–60 days of the agency’s request.

Reasonable, data‑informed estimate

Given the above factors and the fact that the press release was published 6 August 2025, a pragmatic timeline would look like this:

Thus, from the moment of certification (August 2025) to the point where CyberArk can realistically expect its first government contract to be signed and revenue to start flowing, the typical industry window is roughly **12–18 months. This estimate assumes:

• CyberArk moves quickly to list its SaaS offering on the Digital Marketplace.
• No major policy changes delay the government’s procurement cycles.
• Agencies opt for a “single‑source” award rather than a prolonged competitive tender.

Caveats & variables that could accelerate or delay the timeline

Bottom line

• The press release does not provide a concrete timeline.
  
• Based on typical Australian government procurement rhythms, the conversion from certification to the first contract is likely to fall in the **12‑ to 18‑month range after the August 2025 announcement, with the earliest possible contracts emerging late 2026 if agencies leverage fast‑track mechanisms.**
  

If you need a more precise forecast (e.g., for budgeting or partnership planning), the next step would be to:

1. Contact CyberArk’s Australian sales or government‑affairs team for any internal road‑map they may be willing to share.
   
2. Monitor the Australian Digital Marketplace for the appearance of CyberArk’s “IRAP‑Protected” SaaS listings and any associated RFPs.
   
3. Track procurement calendars of key agencies (Defence, Treasury, Health) to spot when they issue RFI/RFPs that reference the “Protected” classification.
   

These actions will give you the most up‑to‑date, agency‑specific timing signals beyond the high‑level industry estimate provided here.