On this page:
Key changes
The updated ESAF introduces several changes to support a more proportionate and risk-based approach to assurance.
Updated RFFR Core Expectations
The RFFR Core Expectations have been updated to align with controls that are relevant to all Providers. This will help ensure assurance activities remain meaningful and consistent with whole of government obligations.
Category Specific Control Requirements
Category Specific Control Requirements have been introduced to support a more risk based approach to assurance.
Each Provider is now required to demonstrate the implementation of security controls applicable to its assurance category. This approach ensures that assurance expectations remain proportionate to the risks associated with the service delivery environment.
Additional Assurance Category
A new Assurance Category has been introduced to make Provider categorisation more proportional and aligned to each Provider’s risk profile.
The broader range of assurance categories supports a more risk-based approach to assurance. This means lower risk Providers may face fewer assurance requirements, while still ensuring appropriate oversight and assurance outcomes across all Providers.
Reduced emphasis on ISO/IEC 27001
For small to medium Providers, the updated ESAF places less emphasis on ISO/IEC 27001 and greater alignment with the Australian Government Protective Security Policy Framework (PSPF) and the Information Security Manual (ISM).
Refined RFFR accreditation deliverables
The RFFR accreditation deliverables have been updated to better align with Australian Government security expectations. The changes also provide clearer visibility into how services are delivered and the environments used to support them, supporting a more focused and risk-based assurance approach.
Clearer provisions for accreditation revocation, recategorisation and reaccreditation outside the standard cycle
The updated ESAF includes clearer provisions for:
- Accreditation revocation where a Provider cannot demonstrate ongoing compliance with ESAF requirements.
- Recategorisation where a Provider’s risk profile changes.
- Reaccreditation outside the standard cycle where reassessment is required to regain assurance.
Implementation date
The updated ESAF takes effect from 1 October 2026.
Transitional arrangements
The department has put transition arrangements in place to help Providers move to the updated ESAF. Providers will receive further information about the requirements for their Assurance Category, including relevant timeframes and next steps.
The transition approach is intended to:
- Minimise disruption and additional compliance effort for Providers.
- Support clear communication and ongoing engagement with Providers.
Next steps
The department will contact your organisation with information about its assurance category under the updated ESAF and any steps needed to support the transition.
Until then:
- Your current RFFR accreditation remains valid.
- Existing milestones and deliverables still apply.
- You should continue to meet any requirements previously advised by the department.
Further information, including guidance on accessing the updated ESAF and the steps needed to remain compliant, will be provided before the updated framework takes effect on 1 October 2026.
| Key date | Activity |
|---|---|
| 4 September 2026 | The updated ESAF will be included in the Workforce Australia Guidelines for providers delivering Workforce Australia and related employment programs. The updated ESAF that will apply to providers delivering other employment and skills programs outside Workforce Australia, including DEWR Skills, Department of Social Services and National Indigenous Australians Agency programs, will be published on the DEWR website. |
| From 4 September 2026 | Providers should review the updated ESAF. The Right Fit For Risk team will be in touch with all Providers to advise which assurance category they have been assigned under the updated ESAF. |
| 1 October 2026 | The updated ESAF is now in effect. |
| 1 July 2027 | All Providers are to meet the revised ESAF requirements. |
The department may meet with providers before 1 October 2026 to confirm their assurance category and discuss what the changes mean for their organisation.
Additional information
A Frequently Asked Questions page is available to help answer common questions about moving to the updated ESAF.
More information and detailed guidance on the new requirements will be provided as it becomes available.