Overview
What this service does
Right Fit For Risk (RFFR) is the Department of Employment and Workplace Relations' security accreditation for employment services, disability employment and related providers, built on ISO/IEC 27001 and the Essential Eight. Getting accredited is one job. Staying accredited through every surveillance audit, every new subcontractor and every change to the programme is the job that catches providers out.
Managed RFFR takes that ongoing work off your plate. We run the information security management system for you: the policy reviews, the risk register, the evidence collection, the internal audits and the management reviews, and we manage the accreditation cycle with your assessor. Your team keeps delivering services; we keep you accredited.
What's included
Scope of the engagement
- Ownership of the ISMS: policies, risk register and Statement of Applicability kept current
- Evidence collected and organised across the year, not scrambled for before the audit
- Internal audit programme and management reviews, delivered and documented
- Subcontractor and supply-chain assurance under the RFFR requirements
- Essential Eight reporting aligned to the Department's expectations
- Audit liaison, corrective actions and the recertification cycle
- Monthly reporting to your executive team
Who it's for
Right for you if
- Employment services and disability employment providers accredited under RFFR
- Providers onboarding subcontractors who must meet the same requirements
- Organisations whose accreditation currently depends on one person
FAQ
Managed RFFR: common questions
Do we still need an internal security contact?
Yes, one named person who owns decisions. We do the work and bring recommendations; your contact approves them and keeps the executive informed.
Can you take over an ISMS someone else built?
Yes. We review what exists, keep what works, and bring the rest up to the current standard before the next surveillance audit.
Related
Often combined with
Virtual and fractional CISO
A senior security leader on retainer, scaled to the size of your business.
Learn more
Virtual and fractional CTO
Technology direction without an executive hire: architecture, cloud, roadmap and suppliers.
Learn more
ISO/IEC 27001 certification
From gap assessment to certificate, with an ISMS that fits your business.
Learn more
Is your RFFR accreditation resting on one busy person?
Tell us when your next surveillance audit is due and we will scope a managed service that keeps you accredited.