Provider context
Review the requirements DEWR has advised, your assurance scope and any transition arrangements.
Right Fit For Risk (RFFR) Consulting
Right Fit For Risk (RFFR) is the cyber security accreditation approach the Department of Employment and Workplace Relations (DEWR) uses for organisations that deliver its programs, such as employment services providers. It sets out how providers protect the personal and sensitive information they handle. Umbrella Tech helps providers understand the RFFR requirements that apply to them, close the gaps and prepare the evidence DEWR expects.
The problem
The challenge we help you address
RFFR obligations arrive through a deed, and the requirements can feel distant from how a provider's IT is actually run. With the framework recently revised, many providers are unsure which requirements now apply to them and how much of their existing evidence still counts.
The outcome
What the engagement should deliver
A clear view of the requirements DEWR has advised for your organisation, controls that meet them across the systems that hold program information, and documentation prepared on DEWR's templates. You also gain owners and routines that keep accreditation evidence current.
How we can help
Systems and dependencies
Map where participant information lives, including third-party systems and suppliers.
Gap assessment
Compare controls and records with the requirements for your category.
Remediation
Deliver the technical and procedural changes, including Essential Eight uplift.
Assurance evidence
Organise the documentation and records DEWR will review.
Planning for the revised assurance framework
DEWR's revised External Systems Assurance Framework (ESAF), under which RFFR sits, took effect on 1 October 2026. Providers are assigned an assurance category, and the requirements and transition dates DEWR advises to your organisation are the authority. We plan the technical and evidence work around them, keeping existing accreditation arrangements visible during the transition.
How RFFR relates to other frameworks
RFFR has been built on ISO/IEC 27001, supplemented by the Australian Government Information Security Manual (ISM), and it expects providers to work towards Essential Eight maturity. Existing work against either framework is useful, but it does not replace the requirements DEWR sets.
Assessment and implementation options
AssessmentRFFR Readiness Assessment
An RFFR readiness assessment for DEWR providers: confirm your category, map program information and…
Explore → AssessmentRFFR Gap AssessmentGet a structured RFFR gap assessment from Umbrella Tech, with clear findings, risk priorities and an…
Explore → ServiceRFFR Remediation & ImplementationRFFR remediation and implementation for DEWR providers: close confirmed gaps, uplift controls and prepare…
Explore →Frequently asked questions
Can't see your question? Ask us directly →
What is RFFR?
Right Fit For Risk is DEWR's approach to cyber security assurance for the external IT systems providers use to deliver its programs. Accreditation is scaled to each provider's size and risk profile.
Who needs it?
Organisations that sign a deed with DEWR to deliver its programs, including employment services providers. Your deed and DEWR's advice to your organisation confirm what applies.
What are the main requirements?
They depend on your assurance category. Providers typically need defined scope, documented security controls on DEWR's templates, cyber security incident management, Essential Eight controls and the evidence that shows them operating.
How long does implementation take?
It depends on your category, the systems and suppliers involved, existing controls and DEWR's transition dates. We confirm scope and timing in discovery.
How does it relate to other frameworks?
RFFR draws on ISO/IEC 27001, the ISM and the Essential Eight. An existing ISO/IEC 27001 system or Essential Eight work can support RFFR, but DEWR's requirements remain the measure.
Plan the next improvement
Tell us about the programs you deliver and what DEWR has advised about your assurance category. We will help define a practical starting point.