RFFR templates

Provides a high-level view of your organisation’s current security posture as a basis for discussion with the RFFR team at the Categorisation stage in the RFFR assurance lifecycle.

The PSP is designed to clearly define the scope of services delivered and the information environment used to protect information collected, stored, processed and transferred during the secure delivery of departmental programs.

The PSP-A is used to document the current implementation status and description of all applicable controls.

The SAQ is used to demonstrate to the department that your organisation has relevant information security controls in place to support secure delivery of departmental programs.

This form is to be completed when notifying the department of any change in circumstances that may alter your organisation’s risk profile.

Provides example headings and guidance for documenting the ISMS Scope in accordance with ISO/IEC 27001 clause 4, while also communicating key elements of the business, systems and information associated with delivering the Services and describing the Provider’s implementation of the RFFR Core Expectation areas.

Provides a Statement of Applicability template that identifies controls supporting RFFR Core Expectation areas and guides on how to assess control applicability and status information required at all Milestones.

Provides example headings and guidance to be considered when Category 2A Providers are documenting their self-assessment.