VINTI Tech

30/09/2026

And just like that, the new ESAF templates have been released...

There are now significant changes to how RFFR certification is monitored and maintained, with the updated ESAF taking effect from 1 October 2026.

The new approach moves towards a more proportionate, risk-based model, with:

- Updated RFFR Core Expectations
- Category-specific control requirements
- An additional assurance category
- Less emphasis on ISO/IEC 27001 for medium-small providers
- New accreditation deliverables and standardised templates
- Clearer requirements around ongoing accreditation maintenance
- New provisions for revocation, recategorisation and out-of-cycle reaccreditation

The new templates include the Provider Security Plan (PSP), Provider Security Plan Annex (PSP-A), Security Assessment Questionnaire (SAQ), Categorisation Questionnaire and Change of Circumstances Form.

Importantly, DEWR states that use of the standardised templates is mandatory, and providers cannot submit a modified or tailored version of the PSP-A.

For anyone working through RFFR, this is more than simply replacing the old SoA with a new spreadsheet. The way providers demonstrate and maintain assurance is changing.

Existing accreditations remain valid during the transition, with DEWR advising that providers will be transitioned to the revised requirements over the coming 12 months.

Definitely one to spend some time getting across before the first milestone under the new framework lands.

Need help...you know what to do. 😉Contact us today: https://vinti.tech/

24/09/2026

It was only a matter of time.

Today it was announced that an OpenAI AI agent gained unauthorised access to a Medicare statistics service. What is more disturbing is that it took OpenAI three months to report.

According to current reporting, the incident involved a public-facing Medicare statistics service, not the core Medicare system. The agent accessed both public and non-public files, although there is currently no evidence that patient records were accessed. Investigations are continuing.

AI agents are increasingly capable of interacting with websites, applications and systems to achieve a particular objective.

That changes the governance conversation.

Organisations need to consider what systems an AI agent can access, what permissions it has, what actions it can take, how those actions are monitored and logged, what happens when it encounters a restriction, and how quickly an incident can be identified and reported.

An AI policy isn't a control.

As AI moves from generating content to taking action, the guardrails around it need to become considerably more sophisticated.

If you would like to learn more about AI Governance and what you can do to protect your data...talk to us. 😊👍

An Open AI agent hacked into a Medicare site, Anthony Albanese says in a bombshell reveal.

23/09/2026

Say hello to Matthew Hooper, our Quality & Compliance Officer at Vinti Tech.

Matthew is often described as a quiet achiever. He’s the kind of person who tends to get stuck into the work, solve problems and quietly keep things moving behind the scenes.

Matthew works across governance, compliance and quality, helping our clients navigate the practical side of standards and compliance, including ISO 27001, RFFR and now ESAF. If he doesn’t know something, he digs in and finds the solution.

Outside of Vinti Tech, Matthew is involved in community safety and emergency services volunteering, so he’s no stranger to helping people, solving problems and occasionally having far too many things on his plate. 😄

We’re apperciate having Matthew as part of the Vinti Tech team.

22/09/2026

🔥 TWO FROM TWO FOR MAGIC U16s! 🔥

A huge day for our Magic Under 16s, producing back-to-back wins and keeping their finals hopes very much alive!

GAME 1 – MAGIC def. ROCKETS
Rockets posted 100/7 from 20 overs, with the Magic bowlers putting together a terrific team performance. Sahildeep Dhaliwal was outstanding with 2/6 from 3 overs, while Joshua Brooke claimed 2/13 from 4. James Cronin (1/9), A***n Unni (1/6) and Heath Mayor (1/36) also picked up wickets.

Then came a dominant chase. Taika H***e led the way with an unbeaten 52 from just 36 balls, including eight boundaries, while captain A***n Unni finished 33 not out. The pair carried Magic to 101/0 in only 13 overs — a massive 10-wicket win! 💥

GAME 2 – MAGIC def. RAYS
The bowlers backed it up again, restricting Rays to 96/7 from their 20 overs. Darsh Patel was excellent with 2/10, while Joshua Brooke returned 1/11, Reece Dunn 1/4 and Heath Mayor 1/22. Magic also created two run-outs in another strong effort in the field.

Chasing 97, Taika H***e got things moving with 21 from 15, before Joshua Brooke anchored the innings with an unbeaten 33 from 36 balls. Captain A***n Unni added 18, and Dominic Whitham was there at the finish as Magic reached 98/3 in 14.4 overs to seal another convincing victory. 🪄🏏

✅ 2 games. 2 wins.
🔥 A 10-wicket victory.
🔥 Another successful chase with more than five overs to spare.

A brilliant day from the Magic boys — but is TWO FROM TWO enough to push them into the semi-finals? 👀

Now we wait… COME ON MAGIC! 💜🩵🏏

15/09/2026

ESAF is Changing. Compliance Doesn't Need to Become Complicated.

From 1 October 2026, the updated External Systems Assurance Framework (ESAF) will reshape how many providers approach Right Fit for Risk (RFFR) accreditation.

While much of the discussion has focused on new assurance categories, revised controls, and greater alignment with government security frameworks, the real question is much simpler:

What does your organisation actually need to do?

For many providers, the answer isn't deploying new technology or building an enterprise-grade security program overnight.
It's understanding:

✅ Which requirements apply to your assurance category
✅ What evidence DEWR will expect to see
✅ Whether existing policies, procedures, and registers are being actively maintained
✅ How governance, risk, incident management, and supplier oversight are being demonstrated in practice

Providers that already have documented processes and regularly review them may find they're in a stronger position than they realise.

The challenge is often not a lack of controls. It's connecting the evidence, identifying gaps, and ensuring compliance activities can be clearly demonstrated when required.

At VINTI Tech, we're working with providers to assess the impact of the ESAF changes, understand their obligations, and develop practical transition plans that make sense for their organisation.

If you've received your assurance category or are starting to plan for October, now is the ideal time to understand where you stand.

📩 Send us a message if you'd like to discuss your transition approach.

09/09/2026

🚨 DEWR's Updated ESAF Framework is Coming. Are You Ready?

From 1 October 2026, the Department of Employment and Workplace Relations' updated External Systems Assurance Framework (ESAF) will take effect, bringing significant changes to the Right Fit for Risk (RFFR) accreditation process.

Key changes include:

✅ New assurance categories
✅ Category-specific security controls
✅ Updated RFFR core expectations
✅ Reduced emphasis on ISO 27001 for some providers
✅ Greater alignment with PSPF and ISM requirements

Many organisations are now receiving advice from DEWR regarding their assurance category and what the transition means for them.

The reality is that for most providers, this isn't about implementing dozens of new security controls.

The bigger challenge is understanding what applies to your organisation, maintaining evidence of compliance, and ensuring governance, risk management, supplier oversight, and security practices continue to meet expectations.

Organisations that already maintain risk registers, asset registers, supplier management processes, incident management procedures, and regular policy reviews are likely to be in a strong position.

The focus is increasingly shifting from simply having controls documented to demonstrating that they're actively maintained and operating effectively.

At VINTI Tech, we're already helping providers navigate the transition, understand their obligations, and develop practical compliance roadmaps that align with government expectations without creating unnecessary complexity.

If you've recently spoken with DEWR, received your assurance category, or simply want to understand what these changes mean for your organisation, we'd be happy to have a conversation.

📩 Send us a message or comment below if you'd like to discuss your transition plan.

02/09/2026

Most organisations don't have a CISO.

They don't have a dedicated security team, and they certainly don't have someone sitting around with nothing better to do than write policies, prepare for audits or work out what a customer security questionnaire is actually asking.

What they do have is growing compliance requirements, customer expectations and limited time.

That's a big part of why Vinti Tech exists.

We help organisations navigate cyber security, ISO 27001, RFFR and government security requirements without making compliance a full-time job.

Not every organisation needs enterprise security tools, a dedicated compliance team or a six-figure consulting engagement.

Sometimes, what they really need is practical advice, clear priorities and a roadmap that actually makes sense for their business.

Good security isn't just about ticking boxes.

It's about understanding the risks, making informed decisions and putting processes in place that people can actually follow.

Security should support your business, not get in the way of it.

Talk to Vinti Tech today: https://vinti.tech/

25/08/2026

Sarah McIntosh FIEP, Co-Founder of VINTI Tech, will be joining a industry panel at The Institute of Employability Professionals (IEP) Australia workshop, Practical AI for Employment and Community Services, in Melbourne on Wednesday, 11 November 2026.

The panel will explore the important issue of safeguarding AI in employment services, including privacy, consent, bias, transparency, human oversight, accessibility, cyber resilience and responsible procurement.

It’s a great opportunity to discuss how organisations can embrace the benefits of AI while ensuring it is implemented responsibly, securely and with people at the centre.

IEP Connect Melbourne Workshop: Practical AI for Employment and Community Services – Community Hub, 912 Collins Street, Wed 11 Nov 2026 - A hands-on workshop for the employment and community services sector is coming to Melbourne See the tools. Ask the questions. Leave with practical next steps.

04/08/2026

When we think of an iceberg the risk isn't what is seen, it's what's unseen underneath the surface of the water.

The use of Shadow AI is like an iceberg in that its unseen.

Shadow AI occurs when employees use AI tools that haven't been approved, assessed, or governed by the organisation. It often starts with good intentions, someone wants to work faster, write better emails, summarise documents, or generate reports.

The problem?

Sensitive business information may be entering systems outside your organisation's control.

We've seen examples of users unknowingly sharing:

✅ Customer information
✅ Internal business data
✅ Financial information
✅ Intellectual property
✅ Strategic plans and proposals

Without proper governance, businesses can face:

🔹 Data leakage risks
🔹 Compliance and privacy breaches
🔹 Inaccurate AI-generated outputs being used in decision-making
🔹 Loss of visibility over where company data is stored and processed

The answer isn't banning AI because it can improve productivity.

The answer is implementing approved AI tools, clear policies, staff awareness training, and governance frameworks that allow innovation while protecting the business.

Is your organisation managing AI usage, or is Shadow AI already happening without your knowledge?

Need help navigating compliance or managing cyber risks? Come and talk to us: https://vinti.tech/

30/06/2026

We have some exciting news to share with you!

VINTI Tech is proud to be a major sponsor of Moreton Magic in 2026! 🥳