Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:9:p2
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 9 (pt 2/13)
Character Range: 105173–108124

writing by the entity's fraud controller.

Division 4—Incident detection, investigation, response and reporting

4.33  Incident monitoring and detection
 (1) An accredited entity must implement and maintain appropriate mechanisms for:
 (a) preventing and detecting digital ID fraud incidents; and
 (b) alerting the entity's personnel to digital ID fraud incidents.
 (2) Without limiting subrule (1), the mechanisms must include an accessible process for personnel, individuals, enforcement bodies and other entities to report digital ID fraud incidents to the accredited entity on a confidential basis.

4.34  Incident investigation, management and response
 (1) An accredited entity must investigate digital ID fraud incidents unless the incident has been referred to, and has been accepted by, an enforcement body.
 (2) An accredited entity must ensure that its personnel whose duties relate to conducting fraud investigations are appropriately qualified and trained to carry out those duties.
 (3) An accredited entity must implement and maintain mechanisms for responding to digital ID fraud incidents, including procedures that:
 (a) document the entity's processes for responding to digital ID fraud incidents and how it will investigate such incidents; and
 (b) include appropriate criteria for making timely decisions at each critical stage in response to a digital ID fraud incident.
 (4) If an accredited entity cannot investigate a digital ID fraud incident because the entity does not hold any personal information relevant to the incident, the entity must take reasonable steps to assist with the fraud investigation being conducted by other participants in the same digital ID system.
Example: Reasonable steps may include providing information relevant to the incident to another participant in the digital ID system if the entity is authorised to disclose such information.

4.35  Record keeping
 (1) An accredited entity must keep records of:
 (a) decisions to use civil, administrative or disciplinary procedures, or to take no further action, in response to a digital ID fraud incident; and
 (b) the entity's investigation of and responses to digital ID fraud incidents.
 (2) For each reporting period, an accredited entity must prepare a report detailing, in respect of any accredited services provided by the accredited entity in a digital ID system other than the Australian Government Digital ID System, the following:
 (a) the number of digital ID fraud incidents that occurred in the reporting period in relation to the entity's accredited services and DI data environment (if any); and
 (b) for each incident:
 (i) the date and time of the incident;
 (ii) a description of the type of incident;
 (iii) the number of digital IDs affected (if any); and
 (iv) the severity of the incident; and
 (c) a description of the measures taken by the entity in response to the incidents covered by the report.
 (3) Subject to rule 7.8, a