Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p1
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 1/13)
Character Range: 102438–105483

9                                 ISP that conducts authentication using in-device biometric capability         The risks, threats and vulnerabilities specific to the entity's use of in-device biometric capability.

Assessment of risks related to biometric information
 (3) If an accredited entity collects, uses, holds, discloses or destroys biometric information, the entity's fraud control plan must also include details of digital ID fraud risks and associated mitigation strategies and any other actions the entity will take to address risks related to that biometric information and to conducting biometric binding or using biometric information for authentication, including risks relating to:
 (a) using biometric matching algorithms to complete biometric binding;
 (b) using systems for presentation attack detection to complete presentation attack detection;
 (c) any capture, temporary storage, and destruction of biometric information;
 (d) any biometric matching process the entity implements;
 (e) any potential and known threats and attacks to the entity's biometric capability; and
 (f) using any manual processes conducted by assessing officers to complete local biometric binding.

4.32  Review of entity's fraud control plan
 (1) An accredited entity must review and update its fraud control plan:
 (a) at least once in each reporting period; and
 (b) as soon as practicable after:
 (i) the entity becomes aware of any digital ID fraud incident which is of a kind not covered in the entity's fraud control plan or which exceeds the entity's recorded level of tolerance of fraud risks;
 (ii) the entity becomes aware of any breach of a requirement specified in its fraud control plan; and
 (iii) any change in the entity's organisational structure or control, functions or activities, if that change will, or is reasonably likely to, increase fraud risks to the entity's accredited services or DI data environment.
 (2) The entity's review of its fraud control plan must, at a minimum:
 (a) have regard to any significant shifts in the entity's fraud risk, threat and operating environment;
 (b) include an assessment of the appropriateness of the existing fraud control measures and mitigation controls; and
 (c) review and, if necessary, update the goals and strategic objectives in the entity's fraud control plan, including:
 (i) recording whether each goal and strategic objective has been met; and
 (ii) updating the goals and strategic objectives for the next year.
 (3) As soon as practicable after the entity has completed each review of its fraud control plan, the entity must make all necessary amendments to its fraud control plan.
 (4) Any changes to the entity's fraud control plan must be approved in writing by the entity's fraud controller.

Division 4—Incident detection, investigation, response and reporting

4.33  Incident monitoring and detection
 (1) An accredited entity must implement and maintain appropriate mechanisms for:
 (a) preventing and detecting digital ID fraud incidents; and
 (b) alerting