Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p9
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 9/13)
Character Range: 124180–126889

that rule to 'applicant' were to the 'accredited entity'; and
 (b) update the documented boundaries of its DI data environment to ensure it has correctly and completely defined and documented the boundaries of the DI data environment as at the time of the review.

4.53  Statement of scope and applicability
  An accredited entity must review its statement of scope and applicability for completeness and accuracy:
 (a) when it becomes aware of a material change to the extent and nature of threats to its DI data environment; or
 (b) if no such material changes occur—at least once in each reporting period.

Chapter 5—Requirements when providing accredited services

Part 5.1—Accredited identity service providers

Division 1—Generating, managing, maintaining or verifying a digital ID

5.1  General requirements
 (1) When generating a digital ID, an ISP must:
 (a) unless the ISP is generating a digital ID in accordance with an alternative proofing process:
 (i) comply with the requirements in this Part applicable to the accredited service being provided and the manner of providing that service;
 (ii) comply with the Accreditation Data Standards applicable to the accredited service being provided and the manner of providing that service; and
 (iii) verify the identity of the individual using only documents or other credentials of a kind listed in Schedules 1 to 4 which are verified in accordance with the requirement in column 2 of the relevant schedule; and
 (b) at the time of generating the digital ID:
 (i) bind an identity proofing level to the digital ID by complying with each requirement specified as 'must' or 'yes' in the column of the IP Levels Table for the relevant identity proofing level to be bound to the digital ID;
 (ii) for a reuseable digital ID—bind one or more authenticators to the digital ID; and
 (c) must not assert an identity proofing level or authentication level for a digital ID unless:
 (i) other than if the ISP is generating a digital ID in accordance with an alternative proofing process—each of the requirements in the IP Levels Table for that identity proofing level has been met; and
 (ii) each of the requirements in the AL Table for that authentication level has been met.
 (2) An ISP must not assert that its processes for a particular identity proofing level creates assurance for that level that is similar or equivalent to a higher identity proofing level.

5.2  Digital IDs and children
 (1) An ISP must not generate a digital ID for an individual who is less than 15 years old.
 (2) If the ISP is generating a digital ID for an individual at IP Level 1, the ISP will not breach subrule (1) if it requires the individual seeking to generate a digital