Get ESAF-ready and keep your RFFR accreditation, all in one place
The Department's External Systems Assurance Framework (ESAF) now sets how IEA providers are categorised and accredited. Assurely helps you manage controls, collect evidence, meet every ESAF deadline and demonstrate RFFR readiness.
Talk to our team →Talk to our team
Tell us which frameworks you need and we’ll arrange a walkthrough of Assurely with a specialist.
Three frameworks. One accreditation. All under ESAF.
We don't chase every standard. We go deep on the two foundations RFFR is built on — then carry you the rest of the way to accreditation.
ISO 27001+Essential Eight→RFFR accreditation under ESAF
From Right Fit For Risk to ESAF
RFFR is the Department of Employment and Workplace Relations' cyber security accreditation framework. If your systems touch the Department's data — employment, skills, or training services — it applies to you. Assurely helps you prepare, manage and demonstrate your compliance posture against it. Under ESAF, RFFR accreditation is the goal your Assurance Category leads to.
- ①
Who it's for
Providers, subcontractors, and vendors of external IT systems that interact with DEWR's systems — handling job-seeker, training, and program data.
- ②
What it's built on
A risk-based blend of ISO 27001 (your ISMS), the Australian Government Information Security Manual, and the ACSC Essential Eight.
- ③
How it's scoped
Risk Category 1 or 2 determines your control depth, captured in a Statement of Applicability (SoA), now the PSP Annex under ESAF, tailored to your engagement.
- ④
How it's kept
Accreditation isn't one-and-done: ongoing reporting, surveillance audits, and a full re-assessment every three years.
- ①
The new umbrella
ESAF replaces the old RFFR arrangements. RFFR accreditation is now one part of it.
- ②
Assurance Category 1–4
Set by the Department at a Categorisation Meeting. It decides what you submit: SAQ, PSP, PSP Annex, or ISO 27001 audit reports.
- ③
PSP Annex replaces the SoA
Core Expectations plus extra controls for your category. Deadlines: categorised by month 1, initial assessment by month 3, accredited by month 9.
- ④
Why it matters
Missed deadlines put your Department agreement at risk. Banned products (DeepSeek, Kaspersky) must go; changes and incidents reported within 5 business days.
Controls you already hold add up to your accreditation readiness.
Do the work once. Stay accredited continuously.
Assurely connects to the tools you already run and turns their signals into living evidence — so audits stop being a fire drill.
Continuous monitoring
Hundreds of automated checks watch your cloud, identity, and endpoints around the clock and flag drift before an auditor would.
Evidence on autopilot
Integrations pull screenshots, configs, and logs straight from source, time-stamped and mapped to the right control — no spreadsheets.
Prove once, satisfy all three
Your ISO 27001 and Essential Eight controls map straight onto the RFFR Statement of Applicability — so one piece of evidence counts across all three frameworks.
Pick your frameworks. We'll help you evidence them.
See how Assurely helps you collect evidence, close gaps and demonstrate your RFFR readiness.