Updated ESAF and RFFR Transition

Key changes

The updated ESAF introduces several changes to support a more proportionate and risk-based approach to assurance.

• Updated RFFR Core Expectations
  The RFFR Core Expectations have been updated to align with controls that are relevant to all Providers. This will help ensure assurance activities remain meaningful and consistent with whole-of-government obligations.
• Category Specific Control Requirements
  Category Specific Control Requirements have been introduced to support a more risk-based approach to assurance.
  Each Provider is now required to demonstrate the implementation of security controls applicable to its assurance category. This approach ensures that assurance expectations remain proportionate to the risks associated with the service delivery environment.
• Additional Assurance Category
  A new Assurance Category has been introduced to make Provider categorisation more proportional and aligned to each Provider’s risk profile.
  The broader range of assurance categories supports a more risk-based approach to assurance. This means lower-risk Providers may face fewer assurance requirements, while still ensuring appropriate oversight and assurance outcomes across all Providers.
• Reduced emphasis on ISO/IEC 27001
  For medium-small Providers, the updated ESAF places less emphasis on ISO/IEC 27001 and greater alignment with the Australian Government Protective Security Policy Framework (PSPF) and the Information Security Manual (ISM).
• Refined RFFR accreditation deliverables
  The RFFR accreditation deliverables have been updated to better align with Australian Government security expectations. The changes also provide clearer visibility into how services are delivered and the environments used to support them, supporting a more focused and risk-based assurance approach.
• Clearer provisions for accreditation revocation, recategorisation and reaccreditation (Out of cycle)
  The updated ESAF includes clearer provisions for:
  • accreditation revocation where a Provider cannot demonstrate ongoing compliance with ESAF requirements,
  • recategorisation where a Provider's risk profile changes, and
  • out of cycle reaccreditation where reassessment is required to regain assurance outside of the standard accreditation schedule.

Implementation dates

The updated ESAF will be published on 4 September 2026 and will take effect from 1 October 2026.

All Providers subject to the ESAF are expected to comply with the updated requirements from 1 October 2026.

Transitional arrangements

The department has put transition arrangements in place to help Providers move to the updated ESAF. Providers will receive further information about the requirements for their Assurance Category, including relevant timeframes and next steps.

The transition approach is intended to:

• minimise disruption and additional compliance effort for Providers, and
• support clear communication and ongoing engagement with Providers.

Next steps

The department will contact your organisation with information about its assurance category under the updated ESAF and any steps needed to support the transition.

Until then:

• your current RFFR accreditation remains valid,
• existing milestones and deliverables still apply, and
• you should continue to meet any requirements previously advised by the department.

Further information, including guidance on accessing the updated ESAF and the steps needed to remain compliant, will be provided before the updated framework takes effect on 1 October 2026.

The following key dates apply to the transition to the updated ESAF:

The department may meet with providers before 1 October 2026 to confirm their assurance category and discuss what the changes mean for their organisation.

Additional information

A Frequently Asked Questions page is available to help answer common questions about moving to the updated ESAF.

More information and detailed guidance on the new requirements will be provided as it becomes available.