Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:5:p1
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 5 (pt 1/3)
Character Range: 89188–92533

5                      ASP                                                    All of the following:
                                                                              (a) the retrieval of any special attribute by a third party;
                                                                              (b) the IP Level of the digital ID used to obtain any special attribute from the ASP; and
                                                                              (c) if available, the unique identifier assigned to the digital ID within the digital ID system in which the ASP operates.

 (7) Subject to rule 7.8, a log required by paragraphs (2)(a) and (b), subrule (5) and subrule (6) must:
 (a) be retained for a minimum of 3 years from the day it was generated; and
 (b) not contain biometric information.

4.21  Cryptography
  An accredited entity must ensure that all personal information collected, used, held or disclosed by or on behalf of the accredited entity is protected in transit and at rest by approved cryptography.

4.22  Cryptographic standards
 (1) An accredited entity must comply with Transport Layer Security 1.3 (TLS 1.3) within the meaning of that term in the ISM.
Note:  The cryptographic standards in the ISM include a requirement to implement the latest version of TLS. At the time these rules were made, the current version of TLS is version 1.3.
 (2) If the entity is unable to comply with TLS 1.3 in relation to an individual because TLS 1.3 is not supported by the individual's device, the entity must:
 (a) comply with TLS version 1.2 or higher; and
 (b) follow any relevant risk mitigation advice in the document titled Implementing Certificates, TLS, HTTPS and Opportunistic TLS published by the ACSC.
Note:  At the time these rules were made, located at https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-cryptography.

4.23  Cryptographic key management processes and procedures
 (1) An accredited entity must develop, implement and maintain documented, effective and secure cryptographic key management processes and procedures for its information technology system.
 (2) The entity's cryptographic key management processes and procedures must cover cryptographic key lifecycle management, including:
 (a) cryptographic key generation;
 (b) registration;
 (c) distribution;
 (d) installation;
 (e) usage;
 (f) protection;
 (g) storage;
 (h) access;
 (i) revocation;
 (j) recovery; and
 (k) destruction.
Note:  If the entity implements ISO/IEC 27001, this rule would be met by the entity complying with clause 8.24 of Annex A of ISO/IEC 27001.

Part 4.2—Fraud control requirements

Division 1—Capability

4.24  Fraud management capability
 (1) Fraud management capability of an accredited entity means the accredited entity's ability to manage fraud in relation to its accredited services and DI data environment through the implementation and operation of processes and controls, including by:
 (a) allocating adequate budget and resources; and
 (b) providing for management oversight.
 (2) An accredited entity's fraud management capability must be appropriate and adapted to respond to fraud risks, having regard to:
 (a) the extent and nature of personal information that the entity holds;
 (b) the extent and