Obligations
Confirm your deed, assurance category, advised requirements and transition dates.
RFFR Readiness Assessment
An RFFR readiness assessment, often called a Right Fit For Risk assessment, shows how prepared a provider is to meet the Right Fit For Risk (RFFR) requirements the Department of Employment and Workplace Relations (DEWR) has advised for it. Umbrella Tech confirms your assurance category and scope, reviews your systems, suppliers and evidence at a high level, and gives you a clear picture of RFFR readiness and the order in which to tackle the work.
When this assessment is useful
Use a readiness assessment when DEWR has confirmed or changed your assurance category, when you are preparing for a new deed, or when you need to understand what the revised External Systems Assurance Framework (ESAF) means for your existing accreditation. It is broader and lighter than a control-by-control gap assessment, and helps decide whether one is needed.
Assessment scope
Information flows
Map where participant information is stored and processed, including third-party systems and suppliers.
Control overview
Review security governance, incident management, access, devices and Essential Eight maturity at a high level.
Documentation
Check the state of required documents and evidence on DEWR's templates.
Evidence and access
Depending on scope, evidence may include your deed and DEWR correspondence, existing accreditation documents, system and supplier lists, security policies, incident procedures, and interviews with program managers. We agree access and handling before the assessment begins.
Your deed and DEWR correspondence
Existing accreditation documents
System and supplier lists
Security policies
Incident procedures
Interviews with program managers
Findings that lead to action
You receive a readiness summary for each area, a list of priority gaps, and a recommended sequence that sets out what to address first. Findings flag where a detailed RFFR Gap Assessment would add value.
Illustrative findingsExamples only
- ExampleParticipant information held in a supplier system nobody has reviewed
- ExampleIncident procedure that does not cover DEWR reporting
- ExampleEssential Eight controls that have not been measured recently
These are examples of what an assessment can uncover, not findings about your organisation.
How it runs
Assessment method
01
Confirm obligations
Review your deed, category and DEWR's advice with the people responsible.
02
Map information and systems
Identify where program information lives and who handles it.
03
Review at a high level
Check governance, controls and documentation against the advised requirements.
04
Prioritise
Present the readiness picture and agree the next steps.
From assessment to remediation
The next step may be a detailed gap assessment or direct remediation through RFFR Remediation & Implementation, delivered by us or your own team.
Assessment outputFindings and remediation roadmap
Umbrella TechWe deliver the improvements
DesignImplementValidate
Your organisationYour internal team
Your partnerYour existing technology provider
Right Fit For Risk
Right Fit For Risk (RFFR) is DEWR's cyber security accreditation approach for providers delivering its programs, under the External Systems Assurance Framework.
About Right Fit For Risk services →Planning for the revised assurance framework
The revised ESAF took effect on 1 October 2026. We work from the requirements and transition dates DEWR advises to your organisation, and keep existing accreditation arrangements visible during the transition.
Frequently asked questions
Can't see your question? Ask us directly →
What does a Right Fit For Risk assessment include?
Confirming your obligations and category, mapping where program information lives, a high-level review of controls and documentation, and a prioritised readiness summary.
How long does the assessment take?
It depends on your category, the number of sites, systems and suppliers, and how quickly information is available. We confirm scope and timing in discovery.
What evidence or access is required?
Your deed and DEWR correspondence, existing accreditation documents, system and supplier lists, and time with IT and program staff. We agree the list first.
What happens after the assessment?
You choose the next step: a detailed gap assessment, remediation, or work by your own team. We can support any of these.
How much does it cost?
Cost depends on your category, the size of the environment and the state of existing documentation. We confirm scope and cost in discovery. Accreditation decisions remain with DEWR.
Establish your current position
Tell us which DEWR programs you deliver and what you have been advised about your category. We will scope a readiness assessment that fits.