Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:10
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 10
Character Range: 85737–87570

10                                 If out-of-band verification is to be made using the PSTN:                                                                                                                                                     the ISP must:
                                                                                                                                                                                                                                                  1.      verify that the pre-registered telephone number being used is associated with a specific physical device; and
                                                                                                                                                                                                                                                  2.     conduct the verification in accordance with the risk-management strategies required to be detailed in the entity's system security plan (see Subdivision 1 of Division 3 of Part 4.1 of Chapter 4 of the Accreditation Rules);
                                                                                                                                                                                                                                                  1.      inform individuals in clear and simple terms of the security risks of using out-of-band verification via the PSTN; and
                                                                                                                                                                                                                                                  2.     offer individuals at least one alternative authenticator that can be used to authenticate to the required authentication level.