Overview
The RFFR Statement of Applicability (SoA) serves as a key governance document within the Australian Government’s Right Fit for Risk cyber security accreditation program. Its purpose is to demonstrate how an organization applies relevant security controls, identifies exclusions, and justifies risk-based decisions in alignment with accreditation standards. The SoA is primarily intended for service providers seeking accreditation to deliver ICT services to government agencies, ensuring transparency and accountability in their cyber security posture.
This framework applies across sectors that interact with government systems, including ICT vendors, managed service providers, and organizations handling sensitive or official information. By requiring organizations to map controls against the Information Security Manual (ISM) and other ASD guidance, the SoA ensures consistency, comparability, and confidence in cyber risk management. Ultimately, it provides government agencies with assurance that accredited providers have implemented appropriate safeguards, while also enabling providers to clearly communicate their compliance and risk management approach.