Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p11
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 11/17)
Character Range: 166726–169586

authenticator, including:
 (a) instructions on how to use the authenticator;
 (b) if the ISP issues authenticators that expire, when the authenticator will expire; and
 (c) what do to if the authenticator is forgotten, lost or stolen.

Part 5.2—Accredited attribute service providers

5.32  Verifying and managing a special attribute
 (1) An ASP must only verify or manage an attribute of an individual if the particular kind of attribute is specified in the ASP's accreditation conditions as an attribute the ASP is accredited to verify and manage (special attribute).
 (2) An ASP must:
 (a) determine the identity proofing level it requires for the purpose of providing its accredited services in respect of a special attribute of an individual; and
 (b) not provide an accredited service in respect of an individual unless the digital ID of the individual meets that identity proofing level.

5.33  Requirements when verifying a special attribute
  When verifying a special attribute of an individual:
 (a) an ASP must ensure the special attribute is:
 (i) unique to the individual; and
 (ii) current at that time; and
 (b) must verify the special attribute with the authoritative source for that special attribute and must do so by:
 (i) establishing a trusted and secure connection with the authoritative source using approved cryptography, including if the ASP and the authoritative source are the same entity; and
 (ii) complying with requirements set by the authoritative source as to the information that must be provided to allow the authoritative source to confirm that the special attribute is unique to that individual.

5.34  Special attributes that are self-asserted
  If a special attribute of an individual is self-asserted by the individual and not verified by the ASP, the ASP must inform an accredited entity or relying party seeking verification or disclosure of the special attribute of each of those facts.

5.35  Special attributes affected by a fraud or cyber security incident
 (1) An ASP must not disclose a special attribute if the ASP is aware that the special attribute has been involved in a cyber security incident or digital ID fraud incident.
 (2) If an ASP becomes aware that a special attribute has been involved in a cyber security incident or digital ID fraud incident, it must immediately notify the authoritative source (if the ASP and the authoritative source are not the same entity).

Part 5.3—Accredited identity exchange providers

5.36  General requirements
  An IXP must securely identify and authenticate each digital ID service provider and relying party involved in a transaction before conveying, managing or facilitating the flow of information between the participants to that transaction.

5.37  Digital ID system rules
 (1) This rule applies to an IXP operating in a digital ID system:
 (a) other than the