Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p1
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 1/21)
Character Range: 32416–35467

8                                          public-facing information related to accredited services  to be taken as a reference to public-facing information related to proposed accredited services.

Chapter 2—Applying for accreditation

2.1  DI data environment
  For the purposes of paragraph 15(4)(d) of the Act, the Digital ID Regulator must not accredit an applicant unless the Regulator is satisfied that the applicant:
 (a) has correctly identified, defined and documented the boundaries of its DI data environment, including:
 (i) the people, processes, technology and infrastructure that will manage, secure, store or otherwise interact with the information generated, collected, used, held or disclosed for the purpose of providing its accredited services, if the applicant is accredited; and
 (ii) the infrastructure owned by, and management provided by, any contractor engaged, or proposed to be engaged, by the applicant to provide a proposed accredited service, or part of a proposed accredited service, if the applicant is accredited;
 (b) has limited the boundaries of its DI data environment to the extent practicable, including by:
 (i) segregating the environment from other systems;
 (ii) minimising the number of people who interact with the information referred to in paragraph (a);
 (iii) limiting the number of systems hosting, processing or accessing the information referred to in paragraph (a); and
 (iv) minimising the use of contracted service providers interacting with the information referred to in paragraph (a).

2.2  Documents to accompany application
  For the purposes of paragraph 141(1)(c) of the Act, an application made by an applicant must be accompanied by:
 (a) a statement of scope and applicability; and
 (b) a statement, signed by the applicant's accountable executive, attesting that:
 (i) the technical testing required by rule 2.5 has been conducted;
 (ii) the accountable executive is satisfied the results of the technical testing demonstrate that the requirements listed in subrule 2.5(2) are met; and
 (iii) if a cloud service provider has conducted penetration testing as required by paragraph 3.8(4)(a)—the applicant is satisfied that that penetration testing covers the kinds of penetration testing in subrule 3.8(2); and
 (c) for biometric testing conducted as required by paragraph 2.3(3)(e), copy of reports of the testing and any required responses to the reports.
Note: An approved form for an application may require additional information and documents to be provided (see section 141 of the Act).

2.3  Criteria to be met
 (1) An applicant must meet the criteria in this rule.
 (2) At the time an applicant applies for accreditation, the information technology system through which it will provide its accredited services if accredited must be operational.
 (3) The applicant must, at the time it applies for accreditation, have conducted:
 (a) assurance assessments in accordance with Chapter 3;
 (b) systems testing in accordance with Chapter 3;
 (c) a privacy impact assessment in