Requirements baseline
Confirm the requirements and controls that apply to your category under the revised framework.
RFFR Gap Assessment
An RFFR gap assessment compares a provider's security controls and evidence, requirement by requirement, with the Right Fit For Risk (RFFR) requirements the Department of Employment and Workplace Relations (DEWR) has set for its assurance category. Umbrella Tech tests what is implemented, records what is missing or unevidenced, and gives you a gap register and remediation plan ready to act on.
When this assessment is useful
Use an RFFR gap analysis once your category and requirements are confirmed and you need a detailed, defensible view before remediation or a DEWR assurance activity. It is also useful when existing accreditation documents no longer match how systems are run, or after a readiness assessment shows significant gaps.
Assessment scope
Control testing
Review access, multi-factor authentication, devices, patching, logging, backups and incident management.
Essential Eight
Assess maturity against the strategies DEWR expects.
Third parties
Check how suppliers and third-party systems handling program information are covered.
Documentation
Compare the required documents with how controls actually operate.
Evidence and access
Depending on scope, evidence may include identity and Microsoft 365 settings, device and patch reports, log and backup records, supplier agreements, incident records, existing accreditation documents, and interviews with control owners. We agree access and handling before testing begins.
Identity and Microsoft 365 settings
Device and patch reports
Log and backup records
Supplier agreements
Incident records
Existing accreditation documents
Interviews with control owners
Findings that lead to action
You receive a gap register mapped to each requirement, with the evidence reviewed, the status and the action needed, plus a prioritised remediation plan. Findings separate missing controls, partly implemented controls and controls that work but lack records.
Illustrative findingsExamples only
- ExampleMulti-factor authentication enforced for staff but not for a supplier's remote access
- ExampleLogs collected but never reviewed
- ExampleDocumented control describing a process the team stopped using
These are examples of what a gap assessment can uncover, not findings about your organisation.
How it runs
Assessment method
01
Set the baseline
Confirm the requirements that apply to your category and the systems in scope.
02
Test controls
Review configuration, records and practice against each requirement.
03
Record gaps
Document status, evidence and the action needed for every requirement.
04
Plan remediation
Prioritise the gaps and agree the remediation sequence and owners.
From assessment to remediation
Close the gaps with your own team or through RFFR Remediation & Implementation. Technical actions often overlap with Essential Eight Remediation.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
Right Fit For Risk
Right Fit For Risk (RFFR) is DEWR's cyber security accreditation approach for providers delivering its programs. It draws on ISO/IEC 27001, the Information Security Manual (ISM) and the Essential Eight.
About Right Fit For Risk services →Planning for the revised assurance framework
The revised External Systems Assurance Framework took effect on 1 October 2026. We assess against the requirements DEWR has advised for your organisation and note any transition dates that affect the plan.
Frequently asked questions
Can't see your question? Ask us directly →
What does an RFFR gap assessment include?
Confirming the requirements for your category, testing controls and evidence against each one, assessing Essential Eight maturity, reviewing third-party coverage, and a gap register with a remediation plan.
How long does the assessment take?
It depends on your category, the number of systems, sites and suppliers, and how quickly evidence can be provided. We confirm scope and timing in discovery.
What evidence or access is required?
Read-only access to identity, device and logging systems, existing documentation and supplier agreements, and time with control owners. We agree the list first.
What happens after the assessment?
You decide how to close the gaps. We can deliver the remediation, support your team, or recheck specific areas before DEWR assurance activity.
How much does it cost?
Cost depends on your category, environment size and existing evidence. We confirm scope and cost in discovery. Accreditation decisions remain with DEWR.
Establish your current position
Tell us your assurance category and what you need to demonstrate. We will scope a gap assessment that gives you a defensible view.