Document ID: chunk:federal_register_of_legislation:F2024L01430:front:0:p5
Version: federal_register_of_legislation:F2024L01430
Segment Type: other
Provision Reference: 
Character Range: 10536–13473

proposed change to the entity's information technology system that interacts with the Australian Government Digital ID System, if the change will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System; and
 (b) any planned or unplanned outage or downtime affecting the entity's information technology system, if the outage or downtime will, or could reasonably be expected to, have a material effect on the operation of the Australian Government Digital ID System.

3.3  Applications for approval to participate—relying parties
 (1) Before a relying party applies for approval to participate in the Australian Government Digital ID System, the entity must conduct a risk assessment to identify, evaluate and manage the risks of:
 (a) a cyber security incident; and
 (b) a digital ID fraud incident;
occurring in connection with a service that the entity intends to provide, or provide access to, within the Australian Government Digital ID System.
 (2) A relying party that has made an application for approval to participate in the Australian Government Digital ID System must, at the time it makes the application, have all of the following:
 (a) a written cyber security plan approved by the entity's governing body that addresses at least the following:
 (i) management of any risks identified when conducting the risk assessment referred to at paragraph (1)(a);
 (ii) prevention, identification, investigation and management of cyber security incidents, including incidents notified to the entity by the System Administrator, if the entity is approved to participate in the Australian Government Digital ID System; and
 (iii) the frequency with which the entity will review the plan, being at least once per year; and
 (b) a written digital ID fraud management plan approved by the entity's governing body that addresses at least the following:
 (i) management of any risks identified when conducting the risk assessment referred to at paragraph (1)(b);
 (ii) prevention, identification, investigation and management of digital ID fraud incidents, including incidents notified to the entity by the System Administrator, if the entity is approved to participate in the Australian Government Digital ID System; and
 (iii) the frequency with which the entity will review the plan, being at least once per year; and
 (c) a written disaster recovery and business continuity plan approved by the entity's governing body that addresses at least the following:
 (i) disaster recovery procedures for critical functions of the entity's information technology system within the Australian Government Digital ID System; and
 (ii) the frequency with which the entity will review the plan, being at least once per year.

Part 2—Approval to participate

3.4  Conditions on approval to participate
 (1) For the purposes of subsection 64(5) of the Act, the approval of an entity