Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p8
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 8/17)
Character Range: 158589–161687

soon as practicable:
 (a) prevent further use of that authenticator;
 (b) notify individuals using that kind of authenticator of the security risk;
 (c) offer affected individuals at least one alternative authenticator at the authenticator level required to be bound to the individual's digital ID; and
 (d) address any additional risks to individuals in the ISP's system security plan.

5.25  Physical authenticators
 (1) A physical authenticator means one of the following:
 (a) look-up secrets;
 (b) single-factor one-time password device;
 (c) multi-factor one-time password device;
 (d) single-factor cryptographic software;
 (e) single-factor cryptographic device;
 (f) multi-factor cryptographic software;
 (g) multi-factor cryptographic device;
 (h) out-of-band devices.
 (2) An ISP that conducts authentication using a physical authenticator, must:
 (a) provide individuals with clear instructions about how to protect the physical authenticator against theft or loss; and
 (b) have a mechanism in place to immediately suspend or revoke use of the authenticator if an individual notifies the ISP of the actual, or a suspected, loss or theft of their physical authenticator.

5.26  Authenticator that has been compromised
 (1) If an ISP becomes aware that an individual's authenticator has been lost, stolen, damaged or duplicated without authorisation (compromised authenticator), the ISP must immediately:
 (a) suspend use of the authenticator;
 (b) revoke the authenticator; or
 (c) destroy the authenticator.
 (2) If an ISP reasonably suspects that a transaction involves a digital ID fraud incident or cyber security incident, the ISP must verify that the relevant authenticator has not been compromised.
 (3) To facilitate secure reporting of a compromised authenticator by the individual to the ISP, the individual may authenticate to their digital ID using an alternative authenticator, but, if so, the alternative may only be a memorised secret or physical authenticator.

5.27  Expired and renewed authenticators
 (1) An ISP must not allow an individual to use an authenticator that has expired.
 (2) As soon as practicable after an authenticator has expired, or the ISP has confirmed that an individual has bound a renewed physical authenticator to their digital ID, the ISP must ensure the individual is not allowed to use the authenticator by taking appropriate action considering the authenticator type.
 (3) For the purpose of subrule (2), appropriate action may include ensuring the individual has:
 (a) surrendered, or proved destruction of, a physical authenticator containing attribute certificates signed by the ISP; or
 (b) deactivated the authenticator, uninstalled the authenticator from the device, or had their access to the authenticator revoked.

5.28  Revocation and termination of an authenticator
 (1) An ISP must revoke an authenticator, as soon as practicable, if:
 (a) an individual's digital ID associated with that authenticator ceases to exist;
 (b) an individual requests that the authenticator be revoked; or
 (c) the ISP determines that the individual