Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p16
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 16/17)
Character Range: 179886–182816

the accredited entity has conducted testing for presentation attack detection, a copy of the presentation attack detection report;
 (e) a copy of the accredited entity's cyber security risk assessment;
 (f) a copy of the accredited entity's fraud risk assessment;
 (g) a copy of the accredited entity's report on accessible services prepared in accordance with rule 4.48;
 (h) a copy of the accredited entity's report on any cyber security incidents prepared in accordance with rule 4.18;
 (i) a copy of the accredited entity's report on any digital ID fraud incidents prepared in accordance with rule 4.35;
 (j) a copy of any privacy impact assessment involving the accredited entity's accredited services or DI data environment and a copy of the entity's response to that assessment;
 (k) for an ISP that conducts testing in accordance with paragraph 6.3(3)(c), a copy of those test results; and
 (l) for an ISP that conducted testing using biometric information of an individual for testing activities in the reporting period, a copy of the report of that testing prepared in accordance with subrule 4.50(6).

6.9  Attestation statement
  The report must include an attestation statement, signed by the accredited entity's accountable executive, that attests that in the reporting period to which the report relates:
 (a) the entity has reviewed any changes in accordance with rule 6.3 and correctly identified any material changes;
 (b) the entity has reviewed its:
 (i) system security plan;
 (ii) fraud control plan;
 (iii) disaster recovery and business continuity plan;
 (iv) privacy policy;
 (v) privacy management plan;
 (vi) data breach response plan; and
 (c) each of those plans is appropriate and adapted to respond to risks and threats, including emerging risks and threats, to the entity's accredited services and DI data environment;
 (d) if a cloud service provider conducts penetration testing as referred to in paragraph 3.8(4)(a)—the entity is satisfied that that penetration testing covers the kinds of penetration testing in subrule 3.8(2);
 (e) the entity is satisfied that any condition imposed by the Digital ID Regulator relating to restricted attributes continues to be necessary and appropriate and, if not, a variation to the condition will be sought;
 (f) the entity has complied with the Act, these rules and the Accreditation Data Standards during the relevant reporting period, with the exception of any non-compliance which the entity has notified to the Digital ID Regulator; and
 (g) the entity is not aware of any matters or circumstances that might prevent or adversely affect the entity's ability to comply with the Act, these rules or the Accreditation Data Standards.

Chapter 7—Other matters relating to accreditation

Part 7.1—Matters related to attributes

7.1  Individuals must expressly consent to disclosure of certain attributes of individuals to relying parties
  For the purposes