"Xero does not undertake an IRAP assessment as the requirements of ISO27001 and SOC 2 provide Xero with more comprehensive cover than is required," said Mark Knowles, acting executive general manager security at Xero.