Digital ID (Accreditation) Rules 2024 (Cth)

Digital ID (Accreditation) Rules 2024

I, Katy Gallagher, Minister for Finance, make the following rules.

Dated 7 November 2024

Katy Gallagher Minister for Finance

Contents Chapter 1—Preliminary 1.1 Name 1.2 Commencement 1.3 Authority 1.4 Definitions 1.5 Meaning of taking reasonable steps 1.6 Meaning of authenticated session 1.7 Incorporated instruments 1.8 Application—transitioned accredited entities 1.9 Application—applicants Chapter 2—Applying for accreditation 2.1 DI data environment 2.2 Documents to accompany application 2.3 Criteria to be met 2.4 Privacy impact assessment 2.5 Technical testing 2.6 Matters to which the Digital ID Regulator must have regard 2.7 Matters of which the Digital ID Regulator must be satisfied Chapter 3—Assurance assessments and systems testing Part 3.1—General requirements 3.1 Entity's obligation 3.2 Assessors Part 3.2—Assurance assessments Division 1—Protective security assessment 3.3 Requirements 3.4 Essential strategies review and report 3.5 If a control or strategy is not relevant to an accredited entity 3.6 Requirements Division 3—Accessibility and useability assessment 3.7 Requirements Part 3.3—Systems testing Division 1—Penetration testing 3.8 Penetration testing requirements 3.9 Penetration testing assessor 3.10 Penetration testing report Division 2—Useability testing 3.11 Accessible and inclusive services 3.12 Useability testing requirements 3.13 Useability testing report Division 3—WCAG testing 3.14 Accessible and inclusive services 3.15 WCAG testing requirements 3.16 WCAG testing report Part 3.4—Reports for assurance assessments and systems testing 3.17 Assessor's report 3.18 Entity's response to an assessor's report Chapter 4—Requirements for maintaining accreditation Part 4.1—Protective security controls Division 1—Capability 4.1 Protective security capability Division 2—Protective security frameworks 4.2 Accredited entities must implement a security framework 4.3 Compliance with the PSPF 4.4 Compliance with ISO/IEC 27001 4.5 Implementation and compliance with an alternative framework 4.6 If a control is not relevant to an entity Division 3—Additional protective security controls 4.7 Cyber security risk assessment 4.8 Sharing information about risks 4.9 Eligibility and suitability of personnel 4.10 Advice to individuals 4.11 Support to individuals Subdivision A—System security plan 4.12 Requirements for system security plan 4.13 Review of the system security plan Subdivision B—Cloud service management 4.14 Selection, use and management of cloud services Subdivision C—Incident detection, investigation, response and reporting 4.15 Incident monitoring and detection 4.16 Incident investigation, management and response 4.17 Disaster recovery and business continuity management 4.18 Record keeping Subdivision D—Information technology system controls 4.19 Essential Eight 4.20 Logging requirements 4.21 Cryptography 4.22 Cryptographic standards 4.23 Cryptographic key management processes and procedures Part 4.2—Fraud control requirements Division 1—Capability 4.24 Fraud management capability Division 2—Fraud controls 4.25 Fraud risk assessment 4.26 Sharing information about risks 4.27 Fraud controller 4.28 Fraud awareness training 4.29 Advice to individuals 4.30 Support to individuals Division 3—Fraud control plan 4.31 Fraud control plan 4.32 Review of entity's fraud control plan Division 4—Incident detection, investigation, response and reporting 4.33 Incident monitoring and detection 4.34 Incident investigation, management and response 4.35 Record keeping Part 4.3—Privacy 4.36 Privacy governance code 4.37 Compliance with privacy governance code 4.38 Privacy policy 4.39 Review 4.40 Providing information about express consent 4.41 Duration of express consent 4.42 Data minimisation principle 4.43 Disclosure of personal information for fraud activities 4.44 Privacy awareness training 4.45 Data breach response plan 4.46 Record keeping Part 4.4—Accredited services must be accessible and inclusive 4.47 Application 4.48 Reporting on accessibility 4.49 Accessibility requirements Part 4.5—Biometric information: testing and fraud activities 4.50 Requirements if biometric information is used for testing activities 4.51 Requirements if biometric information is used for fraud activities Part 4.6—Review of DI data environment and statement of scope and applicability 4.52 DI data environment 4.53 Statement of scope and applicability Chapter 5—Requirements when providing accredited services Part 5.1—Accredited identity service providers Division 1—Generating, managing, maintaining or verifying a digital ID 5.1 General requirements 5.2 Digital IDs and children 5.3 One-off digital IDs 5.4 Use of a reusable digital ID 5.5 Step-up of an identity proofing level 5.6 Updating and correcting attributes 5.7 Suspending the use of a digital ID 5.8 Digital IDs affected by a fraud or cyber security incident 5.9 Resuming the use of a digital ID Division 2—Identity proofing and use of credentials Subdivision A—Identity proofing 5.10 IP Levels Table 5.11 Verification using an Australian passport 5.12 Technical verification of credentials 5.13 Source verification using non-government credentials 5.14 Visual verification Subdivision B—Verification using biometric information 5.15 Application 5.16 Requirements for biometric binding 5.17 Requirements for online biometric binding 5.18 Requirements for local biometric binding 5.19 Requirements for technical biometric matching 5.20 eIDVT biometric matching 5.21 Requirements for manual face comparison Subdivision C—Alternative proofing processes 5.22 Accessible and inclusive services 5.23 Requirements for an alternative proofing process Division 3—Generating, binding, managing or distributing authenticators 5.24 General requirements 5.25 Physical authenticators 5.26 Authenticator that has been compromised 5.27 Expired and renewed authenticators 5.28 Revocation and termination of an authenticator Division 4—Accessibility and useability 5.29 Application 5.30 Verification services 5.31 Authentication services Part 5.2—Accredited attribute service providers 5.32 Verifying and managing a special attribute 5.33 Requirements when verifying a special attribute 5.34 Special attributes that are self-asserted 5.35 Special attributes affected by a fraud or cyber security incident Part 5.3—Accredited identity exchange providers 5.36 General requirements 5.37 Digital ID system rules Chapter 6—Annual reviews Part 6.1—Accredited entities to conduct annual reviews 6.1 General requirements 6.2 Reporting periods 6.3 Scope of annual review 6.4 Assurance assessments 6.5 Penetration and presentation attack detection testing Part 6.2—Accredited entities to provide annual reports 6.6 Content of annual report 6.7 If previous timeframes to address risks and recommendations not met 6.8 Information and documents 6.9 Attestation statement Chapter 7—Other matters relating to accreditation Part 7.1—Matters related to attributes 7.1 Individuals must expressly consent to disclosure of certain attributes of individuals to relying parties 7.2 Meaning of restricted attribute of an individual Part 7.2—Accreditation conditions 7.3 Table of accreditation conditions Part 7.3—Reportable incidents 7.4 Reportable incidents 7.5 Change of control for corporations 7.6 Entity no longer providing accredited services Part 7.4—Data standards relating to accreditation 7.7 Digital ID Data Standards Chair to make standards Part 7.5—Record keeping 7.8 General record keeping requirement Schedule 1—Documents or other credentials that are a commencement of identity credential Schedule 2—Documents or other credentials that are a linking credential Schedule 3—Documents or other credentials that are a UitC credential Schedule 4—Documents or other credentials that are a photo ID Schedule 5—PSPF controls