+61 3 9125 0439
  ➤ MELBOURNE | SYDNEY | BRISBANE | PERTH | CANBERRA | AUSTRALIA-WIDE 📞 +61 3 9125 0439
  +61 3 9125 0439
  ➤ MELBOURNE | SYDNEY | BRISBANE | PERTH | CANBERRA | AUSTRALIA-WIDE 📞 +61 3 9125 0439
Get end-to-end Right Fit For Risk (RFFR) accreditation support stress-free with Cyber Forte, a leading cyber security company supporting organisations across Australia.
At Cyber Forte we deliver stress-free, end-to-end Right Fit For Risk (RFFR) accreditation including a powerful compliance tool at an affordable cost. Achieving Right Fit For Risk (RFFR) certification requires more than documentation – it demands structured risk management, board-level oversight, financial accountability, and aligned technical controls. As trusted  Right Fit For Risk (RFFR) accreditation consultants in Australia, Cyber Forte provides practical, regulator-aligned guidance to help organisations prepare with confidence and clarity.
At Cyber Forte, we provide end-to-end  Right Fit For Risk (RFFR) accreditation and consulting services in Australia tailored to regulatory and government-aligned environments. Our team combines practical security expertise with compliance-driven guidance to help organisations achieve and maintain RFFR accreditation in Australia efficiently. We deliver  Right Fit For Risk (RFFR) accreditation services in Australia across Melbourne, Sydney, Brisbane, Perth, Tasmania, Canberra, Adelaide supporting organisations at every stage of their accreditation journey.Â
We know Right Fit for Risk inside-out, making the journey clear, simple, and stress-free.
Clients who follow our structured process achieve certification on the first attempt, or we stand by our work with a money-back guarantee.
Real-time compliance visibility, evidence collection, and action tracking to reduce ongoing manual effort.
Gap assessment, implementation, documentation, certification, ongoing maintenance, and surveillance audits — full Right Fit for Risk lifecycle managed.
With our AI powered compliance platform delivered by our team, we typically fast-track accreditation by ~50% with the fastest turnaround.
With our fixed-price model for Right Fit for Risk certification cost in Australia, you get predictable costs, clear timelines, and no surprises.
We begin with a comprehensive gap review to understand your current security posture and determine the required Right Fit For Risk (RFFR) Milestones (1, 2, and 3) based on your assigned Provider Category (1, 2A, or 2B). Using the results, we create a clear roadmap outlining the specific controls you need to adopt, drawing from ISO/IEC 27001, the Australian Government Information Security Manual (ISM), and any additional RFFR-specific requirements.
We conduct a detailed risk assessment and develop a risk treatment plan aligned with both ISO 27001 and ISM control frameworks. This is tailored to your operating model, the sensitivity of the data you handle, and the DEWR contract scope applicable to your organisation. The process includes defining scope and boundaries, selecting controls, and documenting supporting evidence in an audit-ready format.
We prepare your Statement of Applicability (SoA) using the official RFFR-approved template. This covers all relevant ISO 27001 Annex A controls, ISM requirements, and other contractual security obligations. We assist in determining control applicability, providing clear justifications for inclusion or exclusion, and ensuring the documentation meets assessment and audit expectations.
All controls and documentation are implemented and managed directly within our Compliance Manager platform. Policies, registers, evidence and repositories are centrally maintained, providing a streamlined experience without the need for additional tools or complex onboarding.
The accreditation approach is aligned to the organisation’s RFFR provider category. Category 1 providers, typically associated with higher risk environments or larger caseloads, are required to implement a fully established Information Security Management System (ISMS), obtain independent ISO 27001 certification, and maintain a comprehensive Statement of Applicability (SoA) aligned with both ISO 27001 and Information Security Manual (ISM) controls. Category 2A and 2B providers, which generally operate in lower risk environments or have a more limited scope, may be permitted to complete certain milestones through self-assessment. However, they are still required to conduct formal risk assessments, maintain SoA alignment, and ensure compliance with applicable ISM and ISO security requirements.
We support organisations through each stage of the required RFFR milestones. Milestone 1 focuses on establishing organisational context, conducting maturity assessments, completing required questionnaires, reviewing the IT environment, and defining the accreditation scope. Milestone 2 involves developing the Statement of Applicability (SoA), designing security controls aligned with ISO 27001 and ISM requirements, and preparing the necessary documentation for certification or self-assessment. Milestone 3 includes full implementation of the required controls, demonstrating operational effectiveness through supporting evidence, submitting the required reports, and ensuring the organisation is prepared for audit and accreditation verification.
Achieving Right Fit For Risk (RFFR) accreditation is not the end. Ongoing obligations include periodic surveillance or self-assessments (annually or every three years, depending on category), updates to the SoA following ISM revisions, and changes driven by business growth or new services. We continue to work alongside you to ensure your accreditation remains current, effective, and aligned with DEWR’s evolving security expectations.
Demonstrate accreditation before regulators identify gaps.
Structured preparation minimises compliance weaknesses.
Enhance Board oversight, reporting, and accountability structures.
Align systems with government cyber security expectations.
Build credibility with regulators, participants, and stakeholders.
Position your organisation for contracts requiring security assurance.
An organisation’s provider category determines the level of scrutiny applied during the assessment process. Low-risk providers are generally required to demonstrate basic governance structures, workforce background checks, and financial stability. Medium-risk providers must implement structured risk management frameworks and provide evidence of service quality and operational controls. High-risk providers are subject to more rigorous requirements, including comprehensive governance frameworks, well-maintained risk registers, strong financial sustainability, advanced security controls, and evidence of workforce capability. Cyber Forte assists organisations in identifying their appropriate category and preparing the necessary documentation to meet the applicable requirements.
Controls establish clear Board oversight, structured reporting, strong policy frameworks, and defined accountability across the organisation.
Controls focus on maintaining risk registers, implementing treatment plans, continuous monitoring, and formal incident management processes.
Controls ensure appropriate screening, ongoing training, clearly defined responsibilities, and a strong culture of compliance.
Controls include multi-factor authentication, encryption, access management, logging and monitoring, and structured incident response planning.
We identify applicable RFFR requirements based on your services, funding arrangements, and risk category.
Cyber Forte conducts a comprehensive assessment against Right Fit for Risk (RFFR) governance, financial, workforce, and security expectations.
We develop or uplift: • Risk management frameworks • Governance policies • Security documentation • Statement of Applicability (where applicable)
We guide implementation across people, processes, and technology.
We perform structured readiness reviews and address non-conformities before external scrutiny.
We support your organisation through RFFR audits and regulator engagement.
DEWR assigns organisations to one of three provider categories.
| Category | Accreditation Requirement |
|---|---|
| Category 1 | ISO 27001 Certification and Independent Audit |
| Category 2A | Self-Assessment Report |
| Category 2B | Management Assertion Letter |
| Right Fit for Risk (RFFR) | ISO 27001 |
|---|---|
| Australian Government accreditation | International information security standard |
| Mandatory for DEWR providers | Voluntary unless contractually required |
| Based on ISO 27001 and the Australian Government ISM | Based on ISO 27001 Annex A controls |
| Includes DEWR contractual obligations | Generic information security framework |
| Annual maintenance requirements | Annual surveillance audits by certification bodies |
Secure you business against evolving cyber threats with leading cyber security company in Australia.
Elevate your business’s credibility and client trust with ISO 42001 certification from Cyberforte, a leading ISO 42001 certification company in Melbourne, Australia.
Fast Track SOC2 compliance end to end from Cyber Forte to scale your business and client trust.
In today’s rapidly evolving digital landscape, businesses face increasing cybersecurity threats, from data breaches to ransomware attacks.
Cyber Forte acknowledges the Bunurong People of the Kulin Nation as the traditional custodians of the land on which we work. We pay our respects to Elders past, present and emerging.
Cyber Forte Pty Limited | ABN: 14 636 444 838
