GRC, without the jargon

What Is Right Fit For Risk (RFFR)? A Plain-English Guide

RFFR explained: what Right Fit For Risk is, who DEWR built it for, and its four elements — ISO 27001, the ISM, Essential Eight and your Deed.

The RFFR Accreditation Journey: Milestones & Timeframes

RFFR accreditation end to end — the three milestones, provider categories, key timeframes, and the anniversary date that governs every deadline.

ISO 27001 vs RFFR: What’s the Difference?

ISO 27001 vs RFFR: why RFFR needs a continuous ISMS, the two-classification trap, and the contractual controls you can’t risk-accept.

RFFR Core Expectations: What DEWR Asks Beyond ISO 27001

The RFFR core expectations — personnel, physical and cyber security, plus the supply-chain accountability that catches providers out.

The Essential Eight and RFFR: What Maturity Level Do You Actually Need?

RFFR requires Essential Eight Maturity Level One — but that's the floor, not the target. What DEWR actually asks for, and what ASD's new Essentials series changes.

Scope: The Most Underrated Document in Your ISMS

Why the ISMS scope document is your sharpest tool — it guides implementation, narrows your audit, and under RFFR carries a contractual floor.

The RFFR Statement of Applicability (SoA): A Living Document

Maintaining an RFFR SoA: the quarterly ISM cadence, control status rules, the Not Implemented vs Not Applicable trap, and why it’s never static.

Risk Management•1 July 2026

Information Security Risk Management: The Operational Layer

What belongs on your ISMS risk register: the operational layer, the 12–18 month test, the ownership test, and why control linkage matters.

Risk Management•1 July 2026

Risk Treatment Plans: Turning a Decision Into Action

The four risk treatment options — Mitigate, Avoid, Transfer, Accept (the 4 T’s) — and why transferred risk is only masked, not removed.

Internal Audits and Management Reviews: The Two Artefacts RFFR Never Asks For

RFFR never names internal audit or management review — but ISO 27001 conformance requires both, and their absence is a finding. What each one has to do, and how to run them when you're small.

Incidents and Breach Notification Under RFFR: Three Clocks, Not One

You don't have 30 days. The Workforce Australia and Parent Pathways Deeds give you one business day to tell the Department you suspect a breach. Three clocks, three triggers, and none discharges another.

Supply Chain Under RFFR: Your Subcontractor's Accreditation Is Not Your Assurance

The deed signatory is responsible for their whole supply chain. Why a subcontractor's own RFFR accreditation may not help you, the TPES shared-obligations trap, and why no cloud certification saves you.