What is Right Fit For Risk? It is the Department of Employment and Workplace Relations (DEWR) approach for checking that Providers and external IT systems keep government information secure. Most people call it RFFR. This plain guide explains what it is, who it covers and what happens next if you are in scope.
What Is Right Fit For Risk in Simple Terms?
DEWR runs programs that involve sensitive personal information. When outside Providers deliver those programs, DEWR still has to protect the information. Right Fit For Risk is the way it does that: it sets IT security requirements, assesses each Provider against them and accredits those that meet them.
The word "risk" matters. The requirements scale with how much risk a Provider carries, which is why there are different Categories.
Who Does RFFR Apply To?
It applies to contracted DEWR Providers and to vendors of external IT systems that interact with DEWR systems. Our guides to DEWR RFFR accreditation and RFFR for employment services go into each group.
How the RFFR Process Works
So, what is Right Fit For Risk once you are in it? A short series of steps.
You move through milestones. Milestone 1 defines your scope and assigns your Category. Milestone 2 shows your information security management system (ISMS) is designed to meet RFFR requirements. Milestone 3 shows it is implemented. Once the final milestone shows the risk is low, DEWR grants accreditation. Category 2B Providers skip Milestone 2.
Why RFFR Is Built on ISO 27001
ISO 27001 is the international standard for an ISMS. RFFR uses it as the foundation, so the work you do for RFFR also supports ISO 27001. Read our guide to ISO 27001 ISMS certification to see what the standard asks for.
What to Do If You Are in Scope
If you are still asking what is Right Fit For Risk and whether it affects you, check your Deed first.
Confirm your Category, check the dates in your Deed and start your ISMS early. If you want a guide through the process, see our Right Fit For Risk service. For official programme details, visit the Department of Employment and Workplace Relations website.
Frequently Asked Questions
What does RFFR stand for?
RFFR stands for Right Fit For Risk.
Who runs Right Fit For Risk?
The Department of Employment and Workplace Relations (DEWR) runs and assesses it.
Is RFFR a certificate?
No. DEWR grants RFFR accreditation. ISO 27001 certification is separate, although Category 1 Providers need an independently certified ISMS as part of the process.
Where do I start with RFFR?
Confirm your Category, check your Deed for milestone dates, and begin scoping your ISMS.