Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:8:p15
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 8 (pt 15/21)
Character Range: 70243–73178

of rule 2.3, the words 'for each reporting period' appearing in that subrule are to be ignored.

4.8  Sharing information about risks
  An accredited entity must:
 (a) consider the implications that the entity's decisions related to the management of cyber security risks have for other participants of the digital ID system in which the accredited entity operates; and
 (b) share information on known cyber security risks or cyber security incidents with those participants as appropriate.

4.9  Eligibility and suitability of personnel
  An accredited entity must take reasonable steps to ensure the ongoing eligibility and suitability of its personnel who interact with its DI data environment.
Note:  If the entity implements the PSPF, this rule may be met by the entity complying with the requirements in PSPF Policy 13 (Ongoing assessment of personnel). At the time these rules were made, located at https://www.protectivesecurity.gov.au/.

4.10  Advice to individuals
  An ISP must provide advice to individuals about how to safeguard their digital ID against cyber security risks and update that advice, as soon as practicable, as new risks and threats emerge.

4.11  Support to individuals
 (1) An accredited entity providing public-facing accredited services must provide support services to individuals who have been adversely affected by a cyber security incident.
 (2) For the purposes of subrule (1), support services must include, at a minimum, the provision of:
 (a) one of the following:
 (i) a monitored chat function; or
 (ii) a monitored email function; or
 (iii) a call centre; and
 (b) a function that allows the individual to speak with a natural person.

Subdivision A—System security plan

4.12  Requirements for system security plan
 (1) An accredited entity must have, maintain and comply with a plan that meets the requirements of this Subdivision (system security plan).
 (2) If an accredited entity implements the PSPF, the entity's system security plan for these rules:
 (a) is the security plan referred to in PSPF Policy 11 (Robust ICT systems); and
 (b) must contain any other information required by these rules to be in the system security plan.
Note: At the time these rules were made, PSPF Policy 11 (Robust ICT systems) was located at https://www.protectivesecurity.gov.au/.
 (3) If an accredited entity implements ISO/IEC 27001, the entity's system security plan must include:
 (a) all documents and processes referred to in ISO/IEC 27001 which together comprise the entity's 'information security management system' within the meaning of that term in ISO/IEC 27001; and
 (b) any other information required by these rules to be in the system security plan.

Goals and strategic objectives
 (4) The entity's system security plan must include details of:
 (a) the entity's goals and strategic objectives to manage and improve its protective security capability; and
 (b) activities the entity will