Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:4
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 4
Character Range: 91215–92471

4                                    Rate limiting (throttling):                                                1.      rate limiting must be implemented and maintained for each of:
                                                                                                                    (i) memorised secrets;
                                                                                                                    (ii) look-up secrets;
                                                                                                                    (iii) single-factor OTPs; and
                                                                                                                    (iv) multi-factor OTPs;
                                                                                                                1.     controls must be implemented and maintained within the entity's information technology system to protect authenticators against online guessing attacks; and
                                                                                                                2.      consecutive failed authentication attempts on the digital ID of an individual must be limited to no more than 100.