Right Fit For Risk (RFFR) accreditation is the DEWR assurance approach that confirms contracted Providers and external IT system vendors meet the Department of Employment and Workplace Relations' IT security requirements. RFFR meaning in practice: a set of milestones, built on ISO 27001, that you complete to show your information security is fit for the risk your contracts carry. ITS247 is an RFFR consultant for Providers across Australia, including RFFR employment services and ICT support Providers.
RFFR Accreditation: What is Right Fit For Risk?
The Department of Employment and Workplace Relations (DEWR) is responsible for protecting the information and data collected and stored in the administration of its programs — including when programs are delivered through external Providers, and when external IT systems interact with DEWR's own systems.
To ensure the confidentiality, integrity, and availability of sensitive information, DEWR requires all contracted Providers and vendors of external IT systems to meet specific IT security requirements. Right Fit For Risk (RFFR) accreditation signifies that a Provider or external IT system has met those requirements, assessed and accredited through DEWR's own RFFR assurance approach.
RFFR Accreditation and Certification: How We Help
RFFR accreditation is granted by DEWR rather than issued as a certificate, but the path to it runs through ISO 27001. Category 1 providers need an independently certified ISO 27001-conforming ISMS, Category 2A providers self-assess against ISO 27001, and Category 2B providers submit a Management Assertion Letter. So when people ask about RFFR certification, they usually mean the ISO 27001 work behind the accreditation.
As an RFFR consultant, ITS247 guides you through each milestone — from scoping your ISMS and preparing the Statement of Applicability to assembling the submission DEWR reviews. Our ISO 27001 service covers the underlying ISMS work.
Right Fit For Risk Accreditation Across Australia
Right Fit For Risk accreditation applies to DEWR providers and vendors wherever they are located. ITS247 supports RFFR accreditation for organisations in Melbourne, Sydney, Canberra, Adelaide, Brisbane, Perth, Newcastle, and Tasmania, working remotely from our Melbourne office with regular visits to each region.
Classification for accreditation
The RFFR approach classifies Providers and Subcontractors into categories to determine their accreditation pathway:
- Category 1 — Providers and Subcontractors delivering services to 2,000 or more individuals per annum across all their Deeds. Third Party Employment and Skills (TPES) System vendors are also classified as Category 1.
- Category 2 — Providers and Subcontractors delivering services to fewer than 2,000 individuals per annum, split into Category 2A (medium risk) and Category 2B (low risk).
| Category | Category 1 | Category 2A | Category 2B |
|---|---|---|---|
| Annual case load | 2,000 or more | Under 2,000 | Under 2,000 |
| Risk profile | Greater risk | Medium risk | Low risk |
| Basis of accreditation | ISO 27001-conforming ISMS, independently certified | ISO 27001-conforming ISMS, self-assessed | Management Assertion Letter |
| Accreditation maintenance | Annual surveillance audit, triennial recertification | Annual self-assessment | Annual management assertion letter |
| Milestones to complete | 1, 2 and 3 | 1, 2 and 3 | 1 and 3 |
Process for accreditation
To demonstrate a secure ICT environment, all Providers undertake an accreditation process with the Department — a set of milestones with check-ins for progress review, risk assessment, and guidance. Each milestone lets a Provider assess their organisation's cyber security posture and implement improvements, while building a customised ISMS that conforms with ISO 27001. Once the final milestone shows risk to systems and government information is low, DEWR grants accreditation.
RFFR Milestone 1 — Scope / context
Initiated through a Provider's RFFR questionnaire, submitted as part of an RFP/RFT response. DEWR reviews the questionnaire, assesses risk, and provides guidance on the milestones ahead — discussing the Provider's business, stakeholders, contractual obligations, information, systems, and practices to determine ISMS scope and assign a Category.
Due within one month of Deed execution for Employment Service Providers and Australian Apprenticeships Support Network Providers; as advised by the Program Manager for other programs. No fixed timeframe for Third Party Employment and Skills Systems Vendors.
RFFR Milestone 2 — Design
Category 1 and 2A Providers demonstrate their ISMS is designed to reflect RFFR requirements for their category — submitting an ISMS scope, a Statement of Applicability, and either an independent assessor's Stage 1 report (Category 1) or a self-assessment report (Category 2A). Category 2B Providers proceed directly to Milestone 3. Due within 3 months of Deed commencement, where applicable.
RFFR Milestone 3 — Implementation
Providers demonstrate progress conforming with ISO 27001 and implementing applicable controls, prioritising those that support RFFR's core expectations. Category 1 submits an updated Statement of Applicability plus an independent assessor's Stage 2 report; Category 2A submits a self-assessment; Category 2B submits a Management Assertion Letter. Unimplemented controls at this stage affect DEWR's assessment of residual risk. Due within 9 months of Deed commencement, where applicable.
Templates for submission
DEWR doesn't require a specific template from Providers except the RFFR questionnaire itself — alternative templates are fine as long as they comply with ISO 27001 requirements, supplemented to reflect RFFR requirements.
| Provider category | Milestone | Template |
|---|---|---|
| Category 1 & TPES Vendors | Milestone 1 | RFFR Questionnaire & Interview |
| Category 1 & TPES Vendors | Milestones 2 & 3 | RFFR Scope Template; ISM to ISO Map |
| Category 2A | Milestone 1 | RFFR Questionnaire & Interview |
| Category 2A | Milestones 2 & 3 | RFFR Scope Template; ISM to ISO Map; RFFR ISO 27001 Self-Assessment Report Template |
| Category 2B | Milestone 1 | RFFR Questionnaire & Interview |
| Category 2B | Milestone 3 | Management Assertion Letter (provided on confirmation of category) |
The latest templates and guidance are published by the Department of Employment and Workplace Relations on dewr.gov.au.
Right Fit For Risk Guides
New to the process? Start with what is Right Fit For Risk. For the detail, read our guides to DEWR RFFR accreditation, RFFR for employment services Providers and what to submit at Milestone 3.
RFFR Accreditation: FAQs
What is Right Fit For Risk (RFFR) accreditation?
Right Fit For Risk accreditation is the assurance approach the Department of Employment and Workplace Relations (DEWR) uses to confirm that contracted Providers and vendors of external IT systems meet its IT security requirements. It is assessed through a series of milestones that build an ISMS conforming with ISO 27001.
Who needs RFFR accreditation?
DEWR requires all contracted Providers and vendors of external IT systems that interact with its systems to meet specific IT security requirements, and RFFR accreditation shows they have. Your category — 1, 2A, or 2B — depends on how many individuals you serve each year and sets your accreditation pathway.
What does RFFR stand for?
RFFR stands for Right Fit For Risk. It is the assurance approach the Department of Employment and Workplace Relations (DEWR) uses to assess and accredit the IT security of contracted Providers and vendors of external IT systems.
What is RFFR Milestone 3?
RFFR Milestone 3 is the implementation milestone. Providers demonstrate progress conforming with ISO 27001 and implementing applicable controls. Category 1 submits an updated Statement of Applicability and an independent assessor's Stage 2 report, Category 2A submits a self-assessment, and Category 2B submits a Management Assertion Letter. It is due within 9 months of Deed commencement, where applicable.
What is DEWR RFFR accreditation and who grants it?
DEWR RFFR accreditation is granted by the Department of Employment and Workplace Relations once your milestone submissions show the risk to its systems and government information is low. It is not a certificate issued by a third party, although Category 1 providers need an independently certified ISO 27001 ISMS to get there.
How does RFFR relate to ISO 27001?
RFFR is built on ISO 27001. Category 1 providers need an independently certified ISO 27001-conforming ISMS, Category 2A providers self-assess against ISO 27001, and Category 2B providers submit a Management Assertion Letter. The ISMS you build for RFFR therefore also supports a standard ISO 27001 certification.
Is RFFR certification the same as ISO 27001 certification?
No. People often say RFFR certification, but RFFR is an accreditation granted by DEWR. ISO 27001 certification is issued by an independent certification body and is one of the ways Category 1 providers evidence their ISMS inside the RFFR process.
Does RFFR apply to employment services providers?
Yes. RFFR applies to contracted DEWR Providers, including Employment Service Providers and Australian Apprenticeships Support Network Providers, and to vendors of external IT systems such as Third Party Employment and Skills (TPES) systems. Milestone 1 is due within one month of Deed execution for these Providers.
What is RFFR compliance in Australia?
RFFR compliance means meeting the IT security requirements DEWR sets for your category (1, 2A or 2B) and completing the required milestones, then maintaining accreditation through annual surveillance audits, annual self-assessments or an annual management assertion letter.
Do you support Right Fit For Risk accreditation in Perth, Newcastle and Tasmania?
Yes. ITS247 supports Right Fit For Risk accreditation for organisations in Melbourne, Sydney, Canberra, Adelaide, Brisbane, Perth, Newcastle and Tasmania, working remotely from our Melbourne office.
Who assesses RFFR submissions?
DEWR reviews your milestone submissions and decides whether to grant accreditation. For Category 1 Providers, an independent assessor also produces the Stage 1 and Stage 2 ISO 27001 reports that go into those submissions.