DEWR RFFR accreditation is how the Department of Employment and Workplace Relations (DEWR) confirms that a Provider or external IT system keeps its information secure. The department grants it. It is not a certificate you buy from a third party. This guide explains who needs it, how the Categories work and what you must do to get and keep it.
What DEWR RFFR Accreditation Means
RFFR stands for Right Fit For Risk. DEWR protects the information it collects through its programs, including when those programs are delivered by outside Providers. To do that, it requires contracted Providers and vendors of external IT systems to meet specific IT security requirements.
The accreditation shows that you have met those requirements. DEWR assesses it through its own RFFR assurance approach, so the decision always sits with the department.
Who Needs DEWR RFFR Accreditation?
It applies to all contracted DEWR Providers and to vendors of external IT systems that interact with DEWR systems. That includes Employment Service Providers, Australian Apprenticeships Support Network Providers and Third Party Employment and Skills (TPES) system vendors. Our guide to RFFR for employment services Providers covers the Provider side in more detail.
The Three Categories
- Category 1: Providers delivering services to 2,000 or more individuals a year, and TPES vendors. The basis is an independently certified ISO 27001-conforming ISMS.
- Category 2A: fewer than 2,000 individuals, medium risk. The basis is a self-assessed ISO 27001-conforming ISMS.
- Category 2B: fewer than 2,000 individuals, low risk. The basis is a Management Assertion Letter.
The Milestones You Complete
Accreditation is earned through milestones. Category 1 and 2A Providers complete Milestones 1, 2 and 3. Category 2B Providers complete Milestones 1 and 3. Milestone 1 sets the scope and assigns your Category, Milestone 2 shows your ISMS is designed properly, and Milestone 3 shows it is implemented. Read our breakdown of what to submit at Milestone 3 before you reach that stage.
Keeping Your Accreditation
Accreditation is not a one-off event. Category 1 Providers need an annual surveillance audit and recertification every three years. Category 2A Providers complete an annual self-assessment. Category 2B Providers submit an annual management assertion letter.
How to Start
Confirm your Category first, because it decides everything that follows. Then build your ISMS around ISO 27001. Our Right Fit For Risk service guides you through each milestone, and the underlying ISO 27001 work is covered separately. For official information, see the Department of Employment and Workplace Relations website.
Frequently Asked Questions
Who grants DEWR RFFR accreditation?
DEWR grants it once your milestone submissions show the risk to its systems and government information is low. A third party does not issue it.
Is DEWR RFFR accreditation the same as ISO 27001 certification?
No. RFFR is built on ISO 27001, but accreditation comes from DEWR. Category 1 Providers do need an independently certified ISO 27001-conforming ISMS as part of the process.
Do all Providers need the same milestones?
No. Category 1 and 2A complete Milestones 1, 2 and 3. Category 2B completes Milestones 1 and 3.
How long does accreditation last?
It is maintained through annual steps: a surveillance audit for Category 1, a self-assessment for Category 2A and a management assertion letter for Category 2B.