Understanding assurance scope, provider responsibilities and transition work.
Right Fit For Risk (RFFR) is the Department of Employment and Workplace Relations (DEWR) approach to assurance over the external IT systems providers use to deliver departmental services. This topic collects Umbrella Tech's RFFR guidance for employment service providers and their IT teams: confirming the requirements advised to you, managing third-party systems and planning work under the revised framework.
Work through each question for your own organisation. Tick it off once you have a clear answer.
Right Fit For Risk: what employment service providers need to show explains who RFFR applies to, what accreditation involves under the updated framework and how it relates to ISO/IEC 27001 and the Essential Eight.
Use the requirements DEWR has advised to your organisation as the basis for planning. Confirm the assurance scope and resolve any questions before committing to an implementation program.
Map which information and services depend on external platforms, cloud services or managed service providers (MSPs). Clarify each party's responsibilities and the evidence they need to supply.
The revised framework may change your preparation priorities. Connect the advised transition arrangements with control work, evidence owners and submission planning, while keeping existing obligations met.
The revised External Systems Assurance Framework took effect on 1 October 2026. Providers should plan against their advised requirements and transition arrangements, including the responsibilities associated with third-party systems.
We help providers prepare: readiness and gap assessments against the requirements advised to you, then remediation of the technical controls, policies and evidence. Accreditation decisions remain with DEWR. The RFFR Readiness Assessment is the usual first step.
Providers that sign a deed with DEWR to deliver its programs, including employment services providers, and the IT teams and managed service providers who run their systems. RFFR has been built on ISO/IEC 27001 and sets Essential Eight targets, so the ISO 27001 and Essential Eight topics are useful background.
A clear scope agreed against your advised requirements, controls in place with evidence, third-party responsibilities documented, and a plan for submission. Timing depends on your scope and the transition arrangements advised to you, which we confirm in discovery.
Right Fit For Risk (RFFR) explains how Umbrella Tech can help assess the current position and plan practical improvements. Use the service scope to identify the evidence, technical work and governance responsibilities your organisation needs.
RFFR obligations arrive through a deed, and the requirements can feel distant from how a provider's IT is…
Explore → AssessmentRFFR Readiness AssessmentAn RFFR readiness assessment for DEWR providers: confirm your category, map program information and…
Explore → AssessmentRFFR Gap AssessmentGet a structured RFFR gap assessment from Umbrella Tech, with clear findings, risk priorities and an…
Explore → ServiceRFFR Remediation & ImplementationRFFR remediation and implementation for DEWR providers: close confirmed gaps, uplift controls and prepare…
Explore →If you need to turn these questions into a defined assessment or delivery plan, tell us about the environment and the outcome you are working towards.