Your RFFR Accreditation Is About to Change. Here Is What We Know

If your organisation delivers a funded employment, skills or disability service, the security framework attached to your funding contract is about to change.

The Department of Employment and Workplace Relations (DEWR) will publish an updated External Systems Assurance Framework ESAF) on 4 September 2026. It takes effect on 1 October 2026.

ESAF is the framework sitting behind Right Fit For Risk accreditation. That distinction matters, because RFFR is not an IT policy. It is tied to your funding contract. Which makes this a contractual event that happens to be about security, rather than a security event that happens to involve your contract.

What the department has said is changing

DEWR has published a summary of the key changes ahead of the framework itself. The stated purpose is a more proportionate and risk-based approach to assurance. Six changes are named.

The RFFR Core Expectations have been updated to align with controls relevant to all providers, so that assurance activities remain meaningful and consistent with whole-of-government obligations.

Category Specific Control Requirements have been introduced. Each provider will need to demonstrate implementation of the security controls applicable to its assurance category, so expectations stay proportionate to the risks of its service delivery environment.

An additional assurance category has been added, to make categorisation more proportional to each provider’s risk profile. The department has said this means lower-risk providers may face fewer assurance requirements, while still maintaining appropriate oversight.

For medium-small providers, the updated framework places less emphasis on ISO/IEC 27001 and greater alignment with the Australian Government Protective Security Policy Framework and the Information Security Manual.

RFFR accreditation deliverables have been refined to better align with government security expectations, and to give clearer visibility into how services are delivered and the environments supporting them.

There are clearer provisions for accreditation revocation where a provider cannot demonstrate ongoing compliance, recategorisation where a risk profile changes, and out of cycle reaccreditation where reassessment is needed outside the standard schedule.

The change most likely to catch people out – look closely at the fourth one

Plenty of medium-small providers have built their entire security program around an ISO 27001 management system. If the emphasis shifts toward PSPF and ISM alignment, that is not a small adjustment. It changes what your evidence looks like, what your documentation needs to demonstrate, and potentially what you have been spending money on.

To be clear about what this is and is not: the department has said there is less emphasis on ISO 27001 for medium-small providers, not that the standard has been dropped. Anyone telling you otherwise is ahead of the facts. But if your program is ISO-shaped, this is the item to read first on 4 September.

The last one deserves attention too. Clearer provisions for revocation give compliance drift a named consequence. For an organisation whose funding depends on accreditation, that is the sentence with the most weight behind it.

What we do not know yet

Which assurance category you land in. That is the single most important variable, and it determines how much of this actually applies to you.

The department has said the Right Fit For Risk team will be in touch with all providers to advise their assigned category under the updated framework, and that it may meet with providers before 1 October to confirm that category and discuss what the changes mean.

In the meantime, the department’s guidance is straightforward. Your current accreditation remains valid, existing milestones and deliverables still apply, and you should continue meeting any requirements previously advised.

What to do between now and 1 October

None of the following depends on knowing your category, which is why it is worth starting now rather than waiting.

• Read the framework when it lands on 4 September, and read it against your own environment rather than in the abstract.
• Know who owns RFFR inside your organisation. Not who manages IT, who owns the accreditation. In a lot of providers those are different people, and in some they are the same overloaded person.
• Check whether you could produce your security evidence today if you were asked. Accreditation deliverables are changing, and the gap between having controls and being able to evidence them is where most providers get caught.
• Take stock of what has changed in your systems since you were last accredited. New platforms, new cloud services, new AI tools. All of it is in scope of how your services are delivered.

If your IT support is external, ask whether they are across your RFFR obligations. Many capable providers are not, because it is a specialised area.

“The providers who handle this well will be the ones who already know who owns their accreditation and where their evidence lives. That is not a technology question, and you can answer it before the framework is even published.” Gavin Hall, Business Technology Consultant Team Lead, Diamond IT

How Diamond IT can help

If you are not sure where to start, a business resilience discovery workshop will help you understand your requirements and right size a solution. From there, we can support you with:

1. Understand your RFFR Obligations: We can help you understand what the latest changes mean for your people, processes and technology so you understand the compliance responsibilities.
2. RFFR Readiness Assessments: We can assess you current security, governance and documentation practices to identify gaps and prioritise the actions needed to improve compliance readiness.
3. Roadmap Development: Creating practical improvement plans that set out what needs to be done, who is responsible, and how it will be managed.
4. Policies, processes, procedures: We can support you in developing or enhancing your business documentation – we can provide recommendations and support right through from performing works, to mentoring your team member or light touch advice. Flexibility is key to making it manageable alongside your ongoing work.
5. Governance and Compliance Advisory Calls: Need to talk to an expert? Our Business Technology Practice has consultants available to provide one off or ongoing advice to help you maintain your compliance, adapt to new changes and stay informed.

We will be reading the updated framework on 4 September and will follow up with what it actually says. If you would like to talk it through before then, get in touch with our team on 1300 307 907, send an email to enquiries@diamondit.com.au or fill out the form below.