Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p15
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 15/17)
Character Range: 177185–180154

such that the entity's personnel can complete the next fraud assurance assessment.

Protective security assessment
 (3) An accredited entity must conduct a protective security assessment in the reporting period after its first reporting period and thereafter in every alternate reporting period.

6.5  Penetration and presentation attack detection testing

Penetration testing
 (1) An accredited entity must cause an assessor to conduct penetration testing, and the entity must provide a report of its response to the assessor's report, in each reporting period.
Note: For penetration testing, see rule 3.8; for the entity's response, see rule 3.18.

Testing for presentation attack detection
 (2) An ISP that conducts online biometric binding or authentication using biometric information using a custom biometric capability must conduct testing for presentation attack detection in the reporting period after its first reporting period and thereafter in every alternate reporting period.
Note: For testing of presentation attack detection technology, see section 2.3 of the Accreditation Data Standards.

Part 6.2—Accredited entities to provide annual reports

6.6  Content of annual report
  The entity's report for each reporting period (annual report) must contain the information and documents required by this Part.

6.7  If previous timeframes to address risks and recommendations not met
 (1) This rule applies if an accredited entity's response to an assessor's report or a privacy impact assessment:
 (a) provides a timeframe for the entity to take measures to address an identified risk or a recommendation in the report or privacy impact assessment; and
 (b) at the time of the entity's annual review, the entity has failed or is likely to fail to implement the measures in accordance with that timeframe.
 (2) The accredited entity must provide in its annual report details of when the measures will be implemented and any risks arising, or likely to arise, from the measures not having already been implemented.
 (3) This rule applies regardless of when the relevant assessor's report or privacy impact assessment was provided to the entity.

6.8  Information and documents
  An entity's annual report must include the following information and documents:
 (a) if the entity has updated the boundaries of its DI data environment in accordance with rule 4.52, a copy of the updated documentation;
 (b) if the entity has updated its statement of scope and applicability in accordance with rule 4.53, a copy of the updated statement;
 (c) if the accredited entity has conducted an assurance assessment or systems testing, a copy of the assessor's report and the entity's response;
 (d) if the accredited entity has conducted testing for presentation attack detection, a copy of the presentation attack detection report;
 (e) a copy of the accredited entity's cyber security risk assessment;
 (f) a copy of the accredited entity's fraud risk assessment;
 (g)