Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p4
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 4/21)
Character Range: 40592–43444

the technical testing conducted:
 (a) the test completion criteria used;
 (b) the assumptions, limitations and dependencies used;
 (c) the methodology used, including a description of the data and environment used to conduct the testing;
 (d) how each test maps to each requirement referred to in subrule (2); and
 (e) the results of the technical testing, including details of any failure to meet the requirements in subrule (2) that is identified and how this failure has been addressed.

2.6  Matters to which the Digital ID Regulator must have regard
 (1) For the purposes of paragraph 15(5)(a) of the Act, in deciding whether to accredit an applicant, the Digital ID Regulator must have regard to the following matters:
 (a) the level of the applicant's tolerance of fraud risks and whether the level is likely to create an unacceptable risk in respect of the proposed accredited services to be provided by the entity if accredited;
 (b) the level of the applicant's tolerance of cyber security risks and whether the level is likely to create an unacceptable risk in respect of the proposed accredited services to be provided by the entity if accredited; and
 (c) whether the applicant's privacy impact assessment and the applicant's response to that assessment identify any matters that may give rise to an unacceptable risk to the privacy of individuals.
 (2) This rule is not limited by paragraph 1.9(3)(b).

2.7  Matters of which the Digital ID Regulator must be satisfied
 (1) For the purposes of paragraph 15(4)(d) of the Act, the Digital ID Regulator must not accredit an applicant unless it is satisfied that the information and documents provided by the applicant demonstrate that the applicant, if accredited, will be able to comply with:
 (a) the Act;
 (b) these rules; and
 (c) the Accreditation Data Standards, to the extent a standard relates to a particular activity to be conducted by the applicant.
Note: Accredited entities must comply with the Accreditation Data Standards applicable to the accredited service being provided and the manner of providing that service (see subparagraph 5.1(1)(a)(ii)).
 (2) This rule is not limited by paragraph 1.9(3)(b).

Chapter 3—Assurance assessments and systems testing

Part 3.1—General requirements

3.1  Entity's obligation
 (1) If an accredited entity is required by a provision of these rules to conduct an assurance assessment or systems testing, the entity must ensure:
 (a) the process for the assurance assessment or systems testing complies with the requirements of this Chapter; and
 (b) the elements of the DI data environment that are being assessed or tested meet the requirements of the Act and these rules relevant to the kind of assurance assessment or systems testing being conducted.
Note: Applicants are required to conduct assurance assessments and systems testing for