Document ID: chunk:federal_register_of_legislation:F2024L01435:reg:4:p1
Version: federal_register_of_legislation:F2024L01435
Segment Type: reg
Provision Reference: reg 4 (pt 1/2)
Character Range: 20745–24025

4                                                                  the testing report and ISP's response:                       1.      the ISP must:
                                                                                                                                 (i) obtain a copy of the testing report from the biometric testing entity; and
                                                                                                                                 (ii) ensure the report confirms that the ISP's presentation attack detection technology has been tested in accordance with ISO/IEC 30107-3:2023 and this Part; and
                                                                                                                                1.     if paragraph (c) of item 3 applies, the ISP must respond in writing to the findings and recommendations in the report as required by section 2.4.

2.4  ISP's response to testing report
  For item 4 in the table in section 2.3, the ISP's response to the testing report must include:
 (a) for each finding and recommendation in the report:
 (i) a risk matrix based on an established risk management framework;
 (ii) a risk assessment;
 (iii) a risk rating in accordance with its risk matrix;
 (iv) a response to each risk identified in the report as requiring treatment; and
 (v) a response to each recommendation in the report; and
 (b) for each risk and recommendation accepted by the ISP:
 (i) details of the action the ISP will take to implement the treatment or recommendation;
 (ii) the timeframe in which the ISP will complete the action, having regard to the risk rating assigned for the risk or recommendation; and
 (iii) the residual risk rating expected following completion of the action; and
 (c) for each risk and recommendation not accepted by the entity:
 (i) the reasons for the non-acceptance;
 (ii) details of alternative actions, if any, to be taken by the entity and the timeframes to do so; and
 (iii) the residual risk rating expected following implementation of any alternative action.

2.5  Testing of biometric matching algorithm
 (1) For biometric testing of technical biometric matching and eIDVT, the biometric matching algorithm must be tested by a biometric testing entity in accordance with the testing and reporting specifications described in ISO/IEC 19795-2:2007 to determine the:
 (a) failure to enrol rate;
 (b) failure to acquire rate;
 (c) false match rate; and
 (d) false non-match rate.
 (2) The biometric matching algorithm must:
 (a) be tested using operational configurations and settings that are consistent with and align to the ISP's operating environment;
 (b) be tested having regard to the range of individuals who may be potential users of the ISP's accredited services;
 (c) be tested using representation from a diverse range of individuals mentioned in paragraph (b), including:
 (i) individuals with disability; and
 (ii) individuals with a diverse range of ability, including ability to use technology; and
 (iii) individuals with a diverse range of age, gender and ethnicity; and
 (d) establish, with a minimum 90% confidence interval, that the algorithm achieves a false match rate of not more than 0.01% and a false non-match rate of not