Right Fit For Risk (RFFR) is the cyber security accreditation approach the Department of Employment and Workplace Relations (DEWR) uses for organisations that deliver its programs. Its purpose is to make sure contracted organisations have adequate security to protect the personal and sensitive information of the people they serve.
The framework has just changed. DEWR's updated External Systems Assurance Framework (ESAF) took effect from 1 October 2026, and all providers are to meet the revised requirements by 1 July 2027. Existing accreditations remain valid during the transition. Some details are still settling, so treat DEWR's pages and your deed as the authority on anything below.
Who it applies to
RFFR covers two groups:
- Providers. Organisations that sign a deed with DEWR to deliver its programs, including employment services providers. DEWR does not assess or accredit organisations that are not deed signatories. In a consortium, each signatory is a provider in its own right and needs its own accreditation.
- Third Party Employment and Skills (TPES) system vendors. Systems that handle information relating to DEWR programs must be accredited before providers use them. A provider using an accredited TPES system still has its own obligations, including written approval from the department before using or changing one.
Accreditation is scaled to each provider's size and risk profile, which is why the assurance category matters.
What accreditation involves
Under the updated framework, DEWR assigns each provider an assurance category, and the RFFR team is contacting providers to confirm theirs. A new category has been added so that lower-risk providers may face fewer assurance requirements. Each provider then demonstrates the security controls that apply to its category, using DEWR's templates, which are mandatory:
- The Provider Security Plan (PSP), which replaces the earlier scope document.
- The PSP-Annex (PSP-A), which replaces the Statement of Applicability and describes the controls in place.
The core expectations also include a formal approach to cyber security incident management that addresses the Information Security Manual (ISM), and providers must continue to report privacy and cyber incidents. Under the process in place before the update, the highest-risk category was independently assessed while lower categories self-assessed. Confirm with DEWR how assessment works for your category now.
How it relates to ISO/IEC 27001 and the Essential Eight
RFFR has been built on ISO/IEC 27001, supplemented by the ISM. The updated ESAF places less emphasis on ISO/IEC 27001 for small and medium providers, with closer alignment to the Protective Security Policy Framework (PSPF) and the ISM. For the highest-risk category, DEWR's assurance lifecycle page still refers to an ISO/IEC 27001 or DEWR ISMS Scheme audit report, so check which applies to you.
On the Essential Eight, providers need controls that reach Maturity Level One in the first instance, and are expected to set target maturity levels that reflect their risk profile and plan to reach them over time. If your organisation has not measured its Essential Eight maturity recently, that is usually the most useful place to begin.
How to prepare
- Confirm your assurance category with DEWR and note any transition dates it gives you.
- Map where participant information lives: your own systems, TPES systems, and any other suppliers who touch it.
- Run a gap assessment against the core expectations and the controls for your category.
- Reach Essential Eight Maturity Level One across the strategies before chasing higher levels.
- Formalise incident management so you can detect, respond to and report incidents.
- Start the PSP and PSP-A early, on DEWR's templates, and keep the evidence behind each control.
Where to start
Our RFFR service helps providers understand their position under the updated framework and turn the requirements into practical controls, processes and evidence. Accreditation decisions remain with DEWR.