RFFR employment services requirements apply to every Employment Service Provider contracted by the Department of Employment and Workplace Relations (DEWR). Right Fit For Risk is the department's way of checking that Providers keep program information secure. This guide sets out what you need to do, in what order and by when.
Why RFFR Employment Services Rules Apply to Providers
RFFR employment services rules exist because Employment Service Providers collect and store sensitive information on behalf of DEWR. The department therefore requires all contracted Providers to meet specific IT security requirements, and RFFR is how it assesses and accredits them. The same applies to Australian Apprenticeships Support Network Providers.
Step 1: Work Out Your Category
Your Category for RFFR employment services depends on your annual case load and risk profile. Providers delivering services to 2,000 or more individuals a year across all their Deeds are Category 1. Smaller Providers are Category 2A (medium risk) or Category 2B (low risk). The Category sets your pathway, so confirm it before you plan any work. Our Right Fit For Risk page includes a comparison table.
Step 2: Plan Around the Milestone Dates
For Employment Service Providers and Australian Apprenticeships Support Network Providers, Milestone 1 is due within one month of Deed execution. Milestone 2 is due within 3 months of Deed commencement, where applicable, and Milestone 3 within 9 months. Category 2B skips Milestone 2. Check your own Deed, because dates depend on your contract.
Step 3: Build an ISMS That Conforms With ISO 27001
RFFR is built on ISO 27001. Category 1 needs an independently certified ISMS, Category 2A a self-assessed one and Category 2B a Management Assertion Letter. If you have no ISMS yet, start with scope and risk assessment. Our ISO 27001 service covers this work, and our plain-English guide to ISO 27001 ISMS certification explains what auditors look for.
Step 4: Prepare Your Submissions
Each milestone has its own submission. At Milestone 3, for example, Category 1 submits an updated Statement of Applicability and an independent assessor's Stage 2 report. We cover this in our Milestone 3 guide.
Where RFFR Employment Services Providers Go Wrong
Common problems are starting too late, treating the work as a paperwork exercise and leaving evidence collection to the last week. Start early and keep records as you go. For official programme information, visit the Department of Employment and Workplace Relations website.
Frequently Asked Questions
Do all Employment Service Providers need RFFR?
Yes. RFFR applies to all contracted DEWR Providers, including Employment Service Providers and Australian Apprenticeships Support Network Providers.
When is Milestone 1 due for Employment Service Providers?
Within one month of Deed execution. Always confirm in your own Deed.
What Category are most small Providers?
Providers delivering services to fewer than 2,000 individuals a year are Category 2A or 2B, depending on risk.
Can ITS247 help an Employment Service Provider through RFFR?
Yes. ITS247 guides Providers through each RFFR milestone, from scoping the ISMS to preparing the submission.