Document ID: chunk:federal_register_of_legislation:F2024L01438:front:0:p1
Version: federal_register_of_legislation:F2024L01438
Segment Type: other
Provision Reference: 
Character Range: 0–3570

Digital ID (Accreditation) Rules 2024

I, Katy Gallagher, Minister for Finance, make the following rules.

Dated 7 November 2024

Katy Gallagher
Minister for Finance

Contents
Chapter 1—Preliminary
1.1  Name
1.2  Commencement
1.3  Authority
1.4  Definitions
1.5  Meaning of taking reasonable steps
1.6  Meaning of authenticated session
1.7  Incorporated instruments
1.8  Application—transitioned accredited entities
1.9  Application—applicants
Chapter 2—Applying for accreditation
2.1  DI data environment
2.2  Documents to accompany application
2.3  Criteria to be met
2.4  Privacy impact assessment
2.5  Technical testing
2.6  Matters to which the Digital ID Regulator must have regard
2.7  Matters of which the Digital ID Regulator must be satisfied
Chapter 3—Assurance assessments and systems testing
Part 3.1—General requirements
3.1  Entity's obligation
3.2  Assessors
Part 3.2—Assurance assessments
Division 1—Protective security assessment
3.3  Requirements
3.4  Essential strategies review and report
3.5  If a control or strategy is not relevant to an accredited entity
3.6  Requirements
Division 3—Accessibility and useability assessment
3.7  Requirements
Part 3.3—Systems testing
Division 1—Penetration testing
3.8  Penetration testing requirements
3.9  Penetration testing assessor
3.10  Penetration testing report
Division 2—Useability testing
3.11  Accessible and inclusive services
3.12  Useability testing requirements
3.13  Useability testing report
Division 3—WCAG testing
3.14  Accessible and inclusive services
3.15  WCAG testing requirements
3.16  WCAG testing report
Part 3.4—Reports for assurance assessments and systems testing
3.17  Assessor's report
3.18  Entity's response to an assessor's report
Chapter 4—Requirements for maintaining accreditation
Part 4.1—Protective security controls
Division 1—Capability
4.1  Protective security capability
Division 2—Protective security frameworks
4.2  Accredited entities must implement a security framework
4.3  Compliance with the PSPF
4.4  Compliance with ISO/IEC 27001
4.5  Implementation and compliance with an alternative framework
4.6  If a control is not relevant to an entity
Division 3—Additional protective security controls
4.7  Cyber security risk assessment
4.8  Sharing information about risks
4.9  Eligibility and suitability of personnel
4.10  Advice to individuals
4.11  Support to individuals
Subdivision A—System security plan
4.12  Requirements for system security plan
4.13  Review of the system security plan
Subdivision B—Cloud service management
4.14  Selection, use and management of cloud services
Subdivision C—Incident detection, investigation, response and reporting
4.15  Incident monitoring and detection
4.16  Incident investigation, management and response
4.17  Disaster recovery and business continuity management
4.18  Record keeping
Subdivision D—Information technology system controls
4.19  Essential Eight
4.20  Logging requirements
4.21  Cryptography
4.22  Cryptographic standards
4.23  Cryptographic key management processes and procedures
Part 4.2—Fraud control requirements
Division 1—Capability
4.24  Fraud management capability
Division 2—Fraud controls
4.25  Fraud risk assessment
4.26  Sharing information about risks
4.27  Fraud controller
4.28  Fraud awareness training
4.29  Advice to individuals
4.30  Support to individuals
Division 3—Fraud control plan
4.31  Fraud control plan
4.32  Review of entity's fraud control plan
Division 4—Incident detection, investigation, response and reporting
4.33  Incident monitoring and detection
4.34