Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p12
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 12/13)
Character Range: 131341–134374

or a suspected cyber security incident, an ISP must:
 (a) verify that the digital ID has not been compromised;
 (b) take reasonable steps to confirm that the individual has effective control of their digital ID; and
 (c) if the ISP has not been able to confirm that the individual has effective control of their digital ID, suspend the use of the digital ID.
Suspected compromised digital ID
 (2) If an ISP detects a digital ID fraud incident or cyber security incident in relation to an individual's digital ID and suspects that the digital ID has been, or is likely to be, compromised, the ISP must suspend the use of that digital ID.

5.9  Resuming the use of a digital ID
 (1) When resuming the use of a digital ID that was temporarily suspended in accordance with rule 5.7, the ISP must ensure:
 (a) the individual completes identity proofing at the identity proofing level of the suspended digital ID and that the attributes presented by the individual can be linked to the attributes which comprise the suspended digital ID; or
 (b) the individual completes biometric binding using a document or other credential whose attributes can be linked to the current attributes which comprise the suspended digital ID.
 (2) When resuming the use of a digital ID that was suspended in accordance with subrule 5.8, the ISP must ensure the individual completes identity proofing at the identity proofing level of the suspended digital ID.
 (3) The ISP is not required to resume the use of a digital ID that was suspended if the ISP no longer holds the information that would enable it to do so.

Division 2—Identity proofing and use of credentials

Subdivision A—Identity proofing

5.10  IP Levels Table
 (1) The IP Levels Table:
 (a) specifies 6 identity proofing levels and the requirements to be met for each of those identity proofing levels when an ISP is binding an identity proofing level to a digital ID of an individual; and
 (b) specifies minimum requirements for each identity proofing level.
 (2) The requirements in the IP Levels Table do not restrict an ISP from applying, for a particular proofing level, the requirements for a higher proofing level (subject to the entity's accreditation conditions).
Example: An ISP may use biometric binding to verify the identity of the individual as part of their fraud controls for IP2, although that is not required for IP2. However, the ISP cannot do so unless authorised to collect the biometric information by an accreditation condition and cannot assert that its IP2 assurance is similar or equivalent to a higher IP level (see subrule 5.1(2)).

IP Levels Table
Item             Requirements                                                                                                                                                                                                                                          IP1              IP1 Plus                                              IP2                                                  IP2 Plus     IP3         IP4