Overview
The RFFR Provider Security Plan Annex (PSP-A) Template is a security assurance document developed by the Department of Employment and Workplace Relations (DEWR) as part of its Right Fit For Risk (RFFR) framework. The PSP-A complements the Provider Security Plan (PSP) by documenting the security controls implemented by a provider to support the secure delivery of departmental services and the protection of information. It serves as the primary mechanism for recording the implementation status, applicability, and description of security controls required under the RFFR assurance framework, enabling providers to demonstrate how security risks are managed across their operational environment.
Introduced as part of the updated External Systems Assurance Framework (ESAF) effective from 1 October 2026, the PSP-A replaces the previous Statement of Applicability (SoA) template. The template is used by providers to document all applicable security controls and provide evidence of their implementation, supporting DEWR's assessment of an organization's cyber security posture and ongoing compliance with RFFR requirements. Together with the Provider Security Plan, the PSP-A forms a key component of the RFFR assurance lifecycle and helps ensure that departmental information is protected through appropriate governance, operational, technical, and security controls.