Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p16
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 16/21)
Character Range: 72911–75906

in the system security plan.

Goals and strategic objectives
 (4) The entity's system security plan must include details of:
 (a) the entity's goals and strategic objectives to manage and improve its protective security capability; and
 (b) activities the entity will undertake to continuously improve that capability.

Destruction of biometric information
 (5) If an ISP collects biometric information, the ISP's system security plan must include details of the processes, procedures and timeframes for the destruction of that biometric information, including destruction of all copies and caches of that information.
 (6) If another person collects biometric information from, or on behalf of, an ISP, the ISP's system security plan must include details of the arrangements in place for the other person to destroy that biometric information, including all copies and caches of that information, in accordance with the same timeframes for destruction of biometric information that apply to the ISP.

Assessment of risks related to biometric information
 (7) If an ISP collects, uses, holds, discloses or destroys biometric information, the ISP's system security plan must include details of any cyber security risks, associated mitigation strategies and any other actions the ISP will take to address risks related to that biometric information, conducting biometric binding, or authentication using biometric information, including risks relating to:
 (a) using biometric matching algorithms to complete biometric binding;
 (b) using systems for presentation attack detection to complete presentation attack detection;
 (c) the capture, temporary storage, and destruction of biometric information;
 (d) the biometric matching process the entity implements; and
 (e) potential and known threats and attacks to the entity's biometric capability;

Use of out-of-band authenticators via PSTN
 (8) If an ISP authenticates an individual by use of an out‑of‑band device via the public switched telephone network (PSTN), the entity must detail in its system security plan:
 (a) the risks of using the PSTN, including but not limited to, risks associated with device swap, SIM change, number porting or other abnormal behaviour; and
 (b) risk management strategies that the entity will implement to address those risks.

4.13  Review of the system security plan
 (1) An accredited entity must review and update its system security plan:
 (a) at least once in each reporting period; and
 (b) as soon as practicable after:
 (i) the entity becomes aware of any cyber security incident which is of a kind not covered in the entity's system security plan or which exceeds the entity's recorded level of tolerance for cyber security risks;
 (ii) the entity becomes aware of any breach of a requirement specified in its system security plan; or
 (iii) any change in the entity's organisational structure or control, functions or activities, if that change will, or is reasonably likely to, increase the level