Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p11
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 11/13)
Character Range: 128912–131572

reference to an ISP in this rule is taken, for the purpose of this rule, to include a reference to that entity at a time before the entity was accredited in accordance with the Act; and
 (b) a reference to an IP level in this rule and in the definition of 'biometric binding' is taken, for the purpose of this rule, to be a reference to an equivalent level of identity proofing.

5.5  Step-up of an identity proofing level
 (1) An ISP may step‑up an individual's identity proofing level for a reuseable digital ID if:
 (a) the step-up is requested by the individual;
 (b) the ISP is accredited to conduct identity proofing at the higher identity proofing level; and
 (c) before starting the step-up process, the individual authenticates to the required authentication level of the higher identity proofing level as required by item 14 in the IP Levels Table.
 (2) When completed, the ISP must notify the individual of the new identity proofing level bound to their digital ID.

5.6  Updating and correcting attributes
 (1) An ISP must allow an individual to update or correct an attribute that the ISP has bound to the individual's digital ID.
 (2) Before binding the updated or corrected attribute to the digital ID of the individual, the ISP must:
 (a) require the individual to authenticate to the authentication level already bound to the digital ID; and
 (b) verify the attribute in accordance with the relevant requirements in the IP Levels Table.
 (3) If the individual's names (family names, given names) or date of birth are not consistent across documents or other credentials presented for verification, the ISP must conduct further verification using a linking credential and must do so in accordance with the requirements in the IP Levels Table.

5.7  Suspending the use of a digital ID
  If an individual requests that an ISP temporarily suspend the use of the individual's digital ID, the ISP must:
 (a) confirm the legitimacy of the request;
 (b) as soon as practicable after confirming the legitimacy of the request, suspend the use of the digital ID;
 (c) following the suspension, notify the individual of the suspension and the process to resume their digital ID.
Note: See rule 5.9 for resumption of a suspended digital ID.

5.8  Digital IDs affected by a fraud or cyber security incident
 (1) If the verification of, update to, or use of, a digital ID is identified as a suspected digital ID fraud incident or a suspected cyber security incident, an ISP must:
 (a) verify that the digital ID has not been compromised;
 (b) take reasonable steps to confirm that the individual has effective control of their digital ID; and
 (c) if the ISP