Document ID: chunk:federal_register_of_legislation:F2024L01430:reg:3:p1
Version: federal_register_of_legislation:F2024L01430
Segment Type: reg
Provision Reference: reg 3 (pt 1/8)
Character Range: 15257–18093

3                         Participating relying party  The entity must collect and store the pairwise identifier issued to the relying party in relation to each individual to enable the entity to comply with the reportable incident requirement mentioned in paragraph 4.2(3)(k).

 (2) The notification must include the following information:
 (a) the entity's name;
 (b) the contact details for the entity;
 (c) if the incident relates to an associated person of the entity—the name and contact details of the associated person; and
 (d) a description of the incident;
 (e) the following details of the incident:
 (i) the date and time of the incident; and
 (ii) the date on which the entity became aware of the incident.

Chapter 4—Reportable incidents

4.1  Application of this Chapter
  For the purposes of subsection 78(1) of the Act, this Chapter prescribes arrangements relating to the notification and management of incidents that have occurred, or are reasonably suspected of having occurred, in relation to the Australian Government Digital ID System.
Note: An entity is liable to a civil penalty if the entity is subject to a requirement under rules made for the purposes of subsection 78(1) and the entity fails to comply with the requirement (see subsection 78(4) of the Act).

4.2  Cyber security incidents and digital ID fraud incidents
 (1) This rule applies to:
 (a) a participating entity;
 (b) an entity whose approval to participate is suspended; and
 (c) an entity whose approval to participate has been revoked, but only in respect of incidents that have occurred, or are reasonably suspected of having occurred, while the entity was participating in the Australian Government Digital ID System.
 (2) The entity must notify the System Administrator, in accordance with this rule, of any of the following:
 (a) a cyber security incident; or
 (b) a digital ID fraud incident;
if the incident occurred, or is reasonably suspected of having occurred, in relation to any accredited services:
 (c) for an accredited entity—provided by the entity within the Australian Government Digital ID System; or
 (d) for a participating relying party—received by the entity within the Australian Government Digital ID System.
 (3) The notification must include the following information:
 (a) the entity's name;
 (b) the contact details of the entity;
 (c) the services affected by the incident;
 (d) a description of the incident;
 (e) the following details of the incident, so far as they are known to the entity:
 (i) the date and time of the incident;
 (ii) the date on which the entity became aware of the incident;
 (iii) the method or source of detection of the incident;
 (iv) the severity of the incident;
 (v) whether the incident has been resolved; and
 (vi) if the incident has been resolved—how it was resolved and how