Right Fit For Risk (RFFR) accreditation readiness

Right Fit For Risk is the Department of Employment and Workplace Relations’ ISO 27001-based information security scheme for providers delivering services under its deeds. Aegentra prepares the provider: scope, Statement of Applicability, controls, evidence and the internal audit. A certification body audits the ISMS and the Department grants accreditation. We do neither, and we say so on every page of the work.

Two decisions, both made by someone else. We prepare you for both.

Right Fit For Risk is the Department of Employment and Workplace Relations’ ISO 27001-based scheme for providers under its deeds. We build or adjust the ISMS so its scope, controls and evidence cover the deed services and the Department’s core expectations, and we run the internal audit through a consultant independent of the build. An accredited certification body then decides the certificate and the Department decides accreditation. Aegentra decides neither and holds no DEWR status.

At a glance

Service	Right Fit For Risk accreditation readiness for DEWR deed providers
Scheme owner	Department of Employment and Workplace Relations (DEWR), which grants accreditation
Basis	ISO/IEC 27001 ISMS whose scope covers the deed services, plus DEWR’s core expectations
Evidence routes	ISO 27001 certificate from an accredited certification body, or the Department’s Statement of Applicability route for smaller providers
Who decides	The certification body decides the certificate; the Department decides accreditation. Aegentra prepares and decides neither
Internal audit	Clause 9.2 audit by a consultant independent of the implementation, or a separate provider
Fee	Scoped and quoted as a fixed fee after a scoping call; no published price
Delivery	Remote across Australia; onsite by arrangement where sites or evidence handling require it

Who needs RFFR accreditation

Any organisation that holds, or is bidding for, a deed with the Department that carries the RFFR requirement, and any subcontractor the deed holder relies on to deliver the services. The requirement follows the deed rather than the size of the provider, so a small specialist provider and a national organisation face the same scheme with different evidence routes. Providers also come to us when their existing ISO 27001 scope does not cover the deed services, or when a surveillance audit or a Department review has raised findings.

Deed holders: Workforce Australia providers and their subcontractors

The requirement follows the deed. A provider delivering services under a deed that carries it, and any subcontractor the deed holder relies on to deliver those services or handle participant information, has to be covered: by its own accreditation, or inside the deed holder’s ISMS scope with flow-down obligations and evidence.

Related programs: Disability Employment Services and other programs where the deed carries the requirement

Providers under Disability Employment Services and related programs face the same scheme, and organisations bidding for a deed must show an accreditation pathway before services start. A small specialist provider and a national organisation meet different evidence routes, not different requirements.

Already certified: Providers whose ISO 27001 certificate does not cover the deed services

A certificate that covers corporate IT but not the systems and sites that deliver the deed services is the most common reason accreditation stalls. We compare the scope statement and the Statement of Applicability with the deed services and extend the ISMS where it falls short; providers moving from the smaller-provider route to full certification as they grow follow the same path.

Right Fit For Risk against plain ISO 27001 certification.

The scheme is built on ISO/IEC 27001, so a provider that already runs an ISMS is most of the way there. The differences sit in scope, the Department’s core expectations and who decides.

Aspect	ISO 27001 certification on its own	Right Fit For Risk
Scope	The organisation chooses the ISMS scope; the certificate’s scope statement records it.	The scope must cover the services delivered under the deed and the systems that hold participant and Department information; a scope that stops at head office stalls accreditation.
Statement of Applicability	Controls selected by risk assessment and recorded in the Statement of Applicability.	The same, plus the Department’s defined Statement of Applicability route for smaller providers, which does not require a certificate.
Core expectations	None beyond the standard’s requirements.	DEWR’s core expectations sit alongside the standard; each is mapped to the control and the evidence that answers it, from the version that applies to your deed.
Internal audit	Clause 9.2 requires an objective, impartial internal audit.	The same clause; where Aegentra built the ISMS, a different consultant independent of the implementation audits it, or a separate provider.
Who decides	An accredited certification body decides the certificate.	The certification body decides the certificate, then the Department decides accreditation. Aegentra prepares for both and decides neither.

How the engagement runs

Named steps, each with what happens and what you receive.

Scope: Draw the boundary around the deed services

A scoping call records the deed services, the systems and sites, whether the route is full ISO 27001 certification or the smaller-provider Statement of Applicability, the starting position and what your team owns. Subcontractors that handle participant information are placed inside or outside the boundary with reasons.

What you receive:

A written ISMS scope that covers the deed services
The evidence route confirmed against the Department’s current requirements for your deed
A fixed-fee quote for the agreed scope

Deed services, sites, systems, suppliers → ISMS boundary → Written scope and fixed fee

Assess: Risk, controls and the core expectations

The risk assessment and treatment select the controls, which are recorded in the Statement of Applicability. The Department’s core expectations are mapped to the controls and to the evidence that shows each one operates; where an ISO 27001 certificate already exists, its scope statement is compared with the deed services.

What you receive:

Risk assessment and treatment plan
The Statement of Applicability
The core expectations mapping, written so a certification body and the Department can read it

Risk assessment → Statement of Applicability → Core expectations mapping

Build: Documented information and records inside your environment

Policies, procedures and records are built where your people already work, and supplier and subcontractor arrangements are settled with the flow-down obligations and evidence each one carries.

What you receive:

Policies, procedures and records that your team operates
Supplier and subcontractor arrangements with their evidence
An evidence set organised for the audits that follow

Agreed controls → Documented information and records → Supplier arrangements

Internal audit: A separate consultant audits what was built

ISO 27001 Clause 9.2 requires an objective, impartial internal audit. A different Aegentra consultant, independent of the implementation, audits the ISMS under documented conflict-of-interest checks, or a separate provider is used; management review follows.

What you receive:

An internal audit report traced to the criterion, the evidence and the corrective action
Management review records
Findings closed before the certification body arrives

ISMS as built → Internal audit, independent consultant → Corrective actions and management review

Hand over: Certification body first, then the Department

The accredited certification body performs its Stage 1 and Stage 2 audits and issues the certificate with a scope statement that covers the deed services; the Department then considers the certificate and its own requirements and grants accreditation. We support both steps and make neither decision.

What you receive:

Audit support through Stage 1 and Stage 2
The certificate scope wording checked against the deed services before the audit
An ISMS built to keep producing evidence for surveillance audits and re-accreditation

Audit-ready ISMS → Certification body, outside Aegentra → Department decision, outside Aegentra

Who it applies to

The requirement follows the deed, not the size of the provider: a small specialist and a national organisation face the same scheme with different evidence routes.

Workforce Australia providers and their subcontractors
Providers under Disability Employment Services and related programs where the deed carries the requirement
Organisations bidding for a deed that must show an accreditation pathway before services start
Providers already certified to ISO 27001 whose certificate scope does not cover the deed services
Providers moving from the smaller-provider Statement of Applicability route to full ISO 27001 certification as they grow

What we deliver

Scope is the first decision: which services, systems, sites, people and suppliers handle participant and Department information. Everything else hangs off that boundary.

ISMS scope covering the deed services, with the systems that hold participant and Department information identified
Risk assessment and treatment, with the controls selected by risk and recorded in the Statement of Applicability
A mapping of the Department’s core expectations to the controls and the evidence that shows each one operates
Policies, procedures and records built inside your environment rather than a template pack
Supplier and subcontractor arrangements, including what flows down to a subcontractor delivering part of the deed
Internal audit and management review before the certification body’s Stage 1 and Stage 2 audits, and the certificate scope wording checked against the deed services before the audit, not after

What we do not do

We say this on every page of the work so nobody reads a readiness engagement as a decision.

We are not a certification body and do not issue ISO 27001 certificates
We are not the Department and do not grant, represent or claim any form of RFFR accreditation or DEWR status
No consultant audits controls they designed or implemented; the Clause 9.2 audit is run by a different Aegentra consultant or a separate provider
We do not represent the Department’s current requirements from memory: you confirm the version that applies to your deed and we work to that
Aegentra does not hold ISO 27001 certification itself and does not deliver services under a DEWR deed

Team qualifications and credentials

Qualifications, professional credentials and formal training held across Aegentra’s delivery team.

Management systems and audit

ISO/IEC 27001 Lead Implementer
ISO/IEC 27701 Lead Implementer
PECB ISO/IEC 27001 Lead Auditor
ISO/IEC 42001 Lead Auditor
CISA — Certified Information Systems Auditor
ISM Auditor

Cybersecurity and cloud

CISSP — Certified Information Systems Security Professional
CISM — Certified Information Security Manager
Certificate of Cloud Security Knowledge (CCSK)
OSCP+ — OffSec Certified Professional Plus

Service delivery and specialist training

ITIL Expert
PRINCE2
Mastering Generative AI for Cybersecurity Certificate
Essential Eight Assessment Course certificate — TAFEcyber

Penetration testing

CREST Registered Penetration Tester (CRT)
CREST Certified Infrastructure Tester (CCT INF)
CREST Certified Web Application Tester (CCT APP)

Penetration testing consultants holding CREST certifications: CRT, CCT INF and CCT APP. These are individual certifications held by the consultants.

Further training and audit qualifications across the team include ISO/IEC 42001 Lead Implementer training, ASD ISM General and Technical audit codes, ISO/IEC 27017 and ISO/IEC 27018 audit codes, and ISO 9001 and ISO 19011 audit qualifications.

Credentials are held across the delivery team and matched to assigned roles. The proposal identifies the consultants, responsibilities and relevant qualification evidence before work begins.

What Right Fit For Risk is

Right Fit For Risk (RFFR) is the information security accreditation scheme the Department of Employment and Workplace Relations (DEWR) applies to providers that deliver services under its deeds, including Workforce Australia and related employment services programs. It is built on ISO/IEC 27001: a provider demonstrates an information security management system whose scope covers the deed services, together with the Department’s core expectations, and the Department grants accreditation on that basis. For larger providers the evidence is an ISO 27001 certificate from a certification body; the Department defines a lighter Statement of Applicability route for smaller providers.

Scheme owner: the Department of Employment and Workplace Relations, which sets the requirements and grants accreditation
Basis: ISO/IEC 27001, with the ISMS scope covering the services delivered under the deed, plus DEWR’s core expectations
Evidence: an ISO 27001 certificate whose scope covers the deed services, or the Department’s defined Statement of Applicability route for smaller providers
Decision makers: the accredited certification body decides the certificate; the Department decides accreditation
Aegentra prepares the provider for both decisions and takes neither

What we prepare

We build or adjust the ISMS so that its scope, controls and evidence cover the deed services and the Department’s core expectations. The first decision is scope: which services, systems, sites, people and suppliers handle participant and Department information, and where the boundary sits. Everything that follows, from the risk assessment to the Statement of Applicability, hangs off that boundary, and it is the first thing a certification body and the Department look at.

ISMS scope covering the deed services, with the systems that hold participant and Department information identified
Risk assessment and treatment, with the controls selected by risk and recorded in the Statement of Applicability
Mapping of the Department’s core expectations to the controls and the evidence that shows each one operates
Policies, procedures and records built inside your environment rather than a template pack
Supplier and subcontractor arrangements, including what flows down to a subcontractor delivering part of the deed
Internal audit and management review before the certification body’s Stage 1 and Stage 2 audits

Certification body first, then the Department

Accreditation runs in two decisions that we prepare for but do not make. An accredited certification body audits the ISMS against ISO 27001 and issues the certificate, with a scope statement that must cover the deed services. The Department then considers the certificate and its own requirements and grants accreditation. A certificate whose scope stops at head office, or a Statement of Applicability that leaves out a system holding participant data, is the most common reason the second decision stalls.

We check the certificate scope wording against the deed services before the audit, not after
The certification body’s fees and the Department’s process are separate from Aegentra’s fee
For the smaller-provider route, we prepare the Statement of Applicability and evidence to the Department’s definition
We do not represent the Department’s current requirements from memory: the provider confirms the version that applies to its deed, and we work to that
Surveillance audits and re-accreditation follow the same logic, and the ISMS is built to keep producing the evidence rather than to pass once

Internal audit and independence

ISO 27001 Clause 9.2 requires an internal audit by someone objective and impartial. Where Aegentra builds the ISMS, a different Aegentra consultant, independent of the implementation work, performs the internal audit subject to documented conflict-of-interest checks, or a separate provider is used where independence cannot be protected. The audit report is written so the certification body can read what was sampled and what was found.

Internal audit scoped separately, with criteria, methods and sampling recorded
No consultant audits controls they designed or implemented
Findings traced to the criterion, the evidence and the agreed corrective action
Our ISO 27001 internal audit service is available on its own for providers who built the ISMS in-house

Readiness work is done inside the provider’s environment: policies, procedures and records where your people already work, organised for the audits that follow.

Frequently asked questions

Who grants Right Fit For Risk accreditation?

The Department of Employment and Workplace Relations. The scheme is the Department’s, and accreditation is its decision. A certification body audits the ISO 27001 ISMS and issues the certificate that larger providers rely on; the Department then grants accreditation. Aegentra prepares the provider for both steps. We are not a certification body, we are not the Department, and we do not claim any status with either.

Do we need ISO 27001 certification for RFFR?

For larger providers the scheme relies on an ISO 27001 certificate whose scope covers the deed services. The Department defines a Statement of Applicability route for smaller providers that does not require a certificate. Which route applies to you depends on the Department’s current requirements for your deed and provider category, which you confirm with the Department; we then prepare the evidence for that route.

We already hold ISO 27001. Why is accreditation stalling?

Usually scope. A certificate that covers corporate IT but not the systems and sites that deliver the deed services, or that excludes a subcontractor who handles participant information, does not demonstrate what the Department is looking for. We compare the certificate scope statement and the Statement of Applicability with the deed services and extend the ISMS where it falls short, then prepare for the scope extension audit with the certification body.

What are the core expectations?

They are the Department’s stated information security expectations of providers under the scheme, which sit alongside the ISO 27001 requirements. We map each expectation to the control and the evidence that answers it so the mapping can be shown to the certification body and the Department. Because the Department maintains and updates the scheme, we work from the version that applies to your deed rather than quoting it from memory.

Does RFFR apply to our subcontractors?

Where a subcontractor delivers part of the deed services or handles participant or Department information, the deed holder has to show how that subcontractor is covered. That can mean the subcontractor holds its own accreditation or is brought inside the deed holder’s ISMS scope with flow-down obligations and evidence. We work through the supplier arrangements as part of the scope decision rather than discovering the gap at audit.

How long does RFFR readiness take?

It depends on the starting position: whether an ISMS exists, how far its scope is from the deed services, how many sites and systems are involved and how quickly evidence can be produced. Certification body scheduling and the Department’s process add time we do not control. We confirm the plan after scoping and record the dependencies, and we do not publish a universal timeline because it would be wrong for most providers.

Can Aegentra audit the ISMS it builds for us?

Not with the same consultant. Clause 9.2 requires objectivity and impartiality. Where Aegentra implements the ISMS, a different competent Aegentra consultant, independent of the implementation work, performs the internal audit subject to documented conflict-of-interest and impartiality checks. If independence cannot be protected, a separate provider is required, and the proposal says which applies.

What does the engagement cost?

It is scoped and quoted as a fixed fee after a scoping call. The main drivers are the route (full certification or the smaller-provider Statement of Applicability), the number of sites and systems, the starting maturity and the subcontractor arrangements. Certification body fees and any Department fees are separate and paid directly to them. We do not publish a price for this service.

Does Aegentra itself hold ISO 27001 certification or RFFR accreditation?

No. Aegentra does not hold ISO 27001 certification and is not an RFFR-accredited provider; it does not deliver services under a DEWR deed. The delivery team’s credentials, including the PECB ISO/IEC 27001 Lead Implementer credential held by the Principal Consultant, are listed on the team page. What we sell is the readiness work, and the decisions stay with the certification body and the Department.

What should we have ready before the scoping call?

The deed or tender reference that carries the requirement, a description of the services you deliver under it, the systems and sites involved, any existing ISO 27001 certificate and its scope statement, and the Department’s current guidance for your provider category. Do not send participant records or credentials; the scoping call is about the boundary of the work, not the data inside it.

Scope and boundaries

What is in the scope, what is quoted separately and what we never do.

Included when agreed	Scope, risk assessment, Statement of Applicability, core expectations mapping, documented information, evidence organisation, internal audit and audit support
Separately scoped	Technical remediation, licences, Microsoft 365 hardening through Harden, and ongoing ISMS operation
Not offered	Certification, accreditation, or a guarantee of either decision
Aegentra’s own status	No ISO 27001 certification of its own and no DEWR status of any kind
Fee	Scoped and quoted as a fixed fee after a scoping call; certification body and Department fees are separate and paid to them

Bring the deed, we will scope the boundary.

Tell us which deed or program carries the requirement, the services you deliver under it and whether an ISO 27001 certificate already exists. A practitioner replies with the readiness scope and a fixed fee; do not send participant records or credentials.

Where the service fits

Related Aegentra services

Related PECB courses

PECB ISO 27001 Lead Implementer course

Training, implementation, internal audit and independent certification have separate scopes and fees.

The management system behind RFFR is built through our ISO 27001 consulting and implementation service, following the ISO 27001 implementation process, and audited before certification through the separately scoped ISO 27001 internal audit. Providers that also supply government systems can read about ISM readiness.

Where we work

Teams in Melbourne and Sydney. Delivered across all Australian states and territories, remotely or onsite by arrangement. New Zealand and Asia Pacific by arrangement.