RFFR Milestone 3 is the implementation stage of the Right Fit For Risk process run by the Department of Employment and Workplace Relations (DEWR). It is where you show that the security system you designed in Milestone 2 is actually working. This guide explains what each Category submits, when it is due, and how to prepare without a last-minute scramble.
What RFFR Milestone 3 Actually Asks For
Right Fit For Risk accreditation is built on ISO 27001. The earlier milestones are about scope and design. RFFR Milestone 3 is about proof. Providers demonstrate progress conforming with ISO 27001 and implementing the applicable controls, starting with the ones that support the core RFFR expectations.
It is not a pass or fail exam on day one. DEWR looks at how far your controls have come and what risk remains. That is why unimplemented controls matter. They feed directly into DEWR's assessment of your residual risk.
What Each Category Submits for RFFR Milestone 3
What you hand in depends on your Category, which is set by your annual case load and risk profile.
- Category 1: an updated Statement of Applicability, plus an independent assessor's Stage 2 report.
- Category 2A: a self-assessment against ISO 27001.
- Category 2B: a Management Assertion Letter. Category 2B skips Milestone 2, so this is the second milestone they complete.
If you are not sure which Category applies to you, start with the classification on our Right Fit For Risk accreditation page.
When Is the RFFR Milestone 3 Submission Due?
For this milestone the timeframe is within 9 months of Deed commencement, where applicable. Milestone 1 comes earlier, within one month of Deed execution for Employment Service Providers and Australian Apprenticeships Support Network Providers. Other programs follow the timing advised by the Program Manager. Check your own Deed, because dates depend on your contract.
How to Prepare Before the Deadline
Most delays come from the same few gaps. Work through them early.
- Confirm your Category and the exact due date in your Deed.
- Review your Statement of Applicability. Every control should be marked as implemented, in progress or excluded, with a reason.
- Collect evidence. Policies, access reviews, training records and incident logs show the controls work in practice.
- Close the highest-risk gaps first, because unimplemented controls raise residual risk.
- Book your independent assessor early if you are Category 1, since Stage 2 availability fills up.
A gap assessment against ISO 27001 is the quickest way to see where you stand. Our ISO 27001 service covers the underlying ISMS work, and our guide to ISO 27001 ISMS certification explains what auditors check.
Common Mistakes at This Stage
The first mistake is treating the submission as paperwork. DEWR wants to see controls running, not only documented. The second is leaving evidence until the week before. The third is assuming the Statement of Applicability from Milestone 2 still holds. Systems and suppliers change, so update it before you submit.
For the official programme information, see the Department of Employment and Workplace Relations website.
Getting Help With Your Submission
ITS247 guides Providers through every RFFR milestone, from scoping the ISMS to assembling the pack DEWR reviews. If your next submission is this one, talk to us early and we will map the work back from your due date.
Related Right Fit For Risk Guides
If you are earlier in the process, read what is Right Fit For Risk and our guide to DEWR RFFR accreditation. Employment Service Providers should also read our RFFR employment services guide.
Frequently Asked Questions
When is RFFR Milestone 3 due?
Within 9 months of Deed commencement, where applicable. Always confirm the date in your own Deed or with your Program Manager.
Does Category 2B have to complete Milestone 3?
Yes. Category 2B Providers skip Milestone 2 and go from Milestone 1 straight to Milestone 3, where they submit a Management Assertion Letter.
What is an independent assessor's Stage 2 report?
It is the report from an independent ISO 27001 assessor confirming your ISMS is operating in practice, not only designed on paper. Category 1 Providers submit it at this milestone.
What happens if some controls are not implemented by Milestone 3?
Unimplemented controls are taken into account when DEWR assesses your residual risk, so prioritise the controls that support RFFR's core expectations first.
Can ITS247 help us prepare for the milestone?
Yes. ITS247 guides Providers through each RFFR milestone, including the Statement of Applicability, the self-assessment and the submission pack.