Re-accreditation overview

On this page:

What is RFFR re-accreditation?

RFFR re-accreditation is the process of continuing acceptance of a Provider or a Third-Party Employment and Skills (TPES) ICT system. Re-accreditation must be completed by the third anniversary of the initial RFFR accreditation date.

Re-accreditation ensures that the ICT system continues to meet the security requirements and standards in accordance with the RFFR framework.

Re-accreditation is issued by the department’s Accreditation Authority.

Who is subject to the re-accreditation process?

All current providers and TPES vendors who have completed the initial accreditation and subsequent accreditation maintenance requirements.

RFFR re-accreditation process

The re-accreditation process commences after the second accreditation maintenance. The department will engage with providers at the commencement of their re-accreditation process to ensure their provider category is appropriate.

The date of re-accreditation becomes the new accreditation anniversary date for the Provider and TPES vendor. This means the next accreditation maintenance must be completed within 12 months of this date.

Below is an example timeline of a RFFR accreditation and re-accreditation.

Initial Accreditation

20 September 2023

Dot (blue)

Accreditation Maintenance 1

  1. Documents required to be submitted by 9 August 2024 (6 weeks before accreditation anniversary)
  2. Accreditation Maintenance 1 achieved 1 September 2024
  3. Due to be completed by 20 September 2024
Dot (blue)

Accreditation Maintenance 2

  1. Documents required to be submitted by 9 August 2025 (6 weeks before accreditation anniversary)
  2. Accreditation Maintenance 2 achieved 25 August 2025
  3. Due to be completed by 20 September 2025
Dot (blue)

Re-accreditation

  1. Documents required to be submitted by 9 August 2026 (6 weeks before accreditation anniversary)
  2. Re-accreditation achieved 31 July 2026
  3. Due to be completed by 20 September 2026
Dot (blue)

In the example above, the re-accreditation date of 31 July 2026 becomes the new accreditation anniversary date. This date will apply to the future accreditation maintenance requirements.

Documents required for re-accreditation

Provider category for RFFR purposes Documents
Category 1
and
Third Party Employment and Skills (TPES) systems
  1. Scope document based on the department’s template
  2. Statement of Applicability using the department’s template
  3. ISO27001 stage-2 audit report or DESE ISMS Scheme report
  4. ISO27001 certificate or DESE ISMS Scheme certificate.
Category 2A
  1. Scope document based on the department’s template
  2. Statement of Applicability using the department’s template
  3. Self-assessment report using the department’s template.
Category 2B
  1. Management Assertion Letter based on the department’s template
  2. Statement of Applicability using the department’s template.

Submission timeframes

The submission of documents for re-accreditation must occur 6 weeks before the anniversary date. This allows time for the department to seek any further information if necessary and provide time for the Accreditation Authority to consider the documents prior to making a decision.