Who must adopt Essential Eight Maturity Level 2 (federal subcontractors)?

Federal government contractors handling OFFICIAL: Sensitive must meet Right Fit For Risk (RFFR) including E8 ML2.

Right Fit For Risk requirements apply to providers handling OFFICIAL: Sensitive Commonwealth data. The ASD Information Security Manual (ISM) and Essential Eight Maturity Model are the baseline. Independent assessment by an IRAP-endorsed assessor is required.

Applies only if you handle OFFICIAL: Sensitive Commonwealth data under contract. Whether it applies turns on a fact that no industry, structure or size settles on its own.

How the regulator frames it: Federal government contractors and subcontractors handling OFFICIAL: Sensitive data.

What triggers it: Government contract requiring RFFR compliance.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires a trigger outside this questionnaire.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business supplies government customers: it becomes worth checking, because it applies only if you handle OFFICIAL: Sensitive Commonwealth data under contract.

The engine shows this obligation as "check whether this applies" when a business has government customers. It then applies only if you handle OFFICIAL: Sensitive Commonwealth data under contract. That fact is not something Rules Mate can infer from industry, structure or size.

When due

Before access to data; annual reassessment.

Frequency

Annual

Evidence to keep

IRAP assessment report, ISM compliance documentation, E8 maturity attestation.

Status

Current

Priority

Critical

Maximum penalty: Loss of contract / panel access; reputational exposure on Commonwealth supplier registers.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• Comply with APRA CPS 234 (Information Security): APRA-regulated entities must maintain information security capability commensurate with the size and extent of threats.
• Report cyber security incidents to ASD (SOCI): Critical infrastructure asset operators must report critical incidents within 12 hours and other incidents within 72 hours.
• Adopt and maintain a Critical Infrastructure Risk Management Program (CIRMP): Covered critical infrastructure entities must adopt a CIRMP addressing cyber, physical, personnel, and supply-chain hazards.
• Government cyber incident reporting via ASD ACSC: Federal entities + critical infrastructure report cyber incidents to ASD ACSC.
• ISO/IEC 27001 ISMS certification — increasingly customer-mandated: Information Security Management System per ISO 27001 increasingly required by customers + government.

Rules Mate tracks 9 published obligations tagged "cyber", 4 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 0 of those apply outright. This obligation is rated critical priority, and is a annual obligation.

Regulated by Australian Signals Directorate (Australian Cyber Security Centre).

ASD: Cyber security guidance and incident response. Publishes the Information Security Manual (ISM), Essential Eight, and Right Fit For Risk requirements for federal subcontractors.

• Australian Signals Directorate (Australian Cyber Security Centre)

Free tools that help with this obligation:

• Essential Eight maturity check
• Cyber incident notifications
• Ransomware payment reporting