Document ID: chunk:federal_register_of_legislation:F2024L01438:reg:14:p7
Version: federal_register_of_legislation:F2024L01438
Segment Type: reg
Provision Reference: reg 14 (pt 7/17)
Character Range: 156096–158858

a digital ID for an individual, an ISP must:
 (a) be satisfied that an exceptional use case exists in respect of the individual;
 (b) conduct a risk assessment, including of any risks to relying parties that may rely on the individual's digital ID if created; and
 (c) prepare and maintain a report of the risk assessment that includes details of any controls and risk mitigation strategies to be implemented in response to the identified risks.
 (4) For the purpose of this rule, exceptional use case means a case where an individual:
 (a) does not possess the documents or other credentials required to be provided to create a digital ID at the identity proofing level sought by the individual; and
 (b) is unable to obtain the documents or other credentials in a reasonable timeframe, having regard to the circumstances as to why the individual is unable to obtain the documents or other credentials.

Division 3—Generating, binding, managing or distributing authenticators

5.24  General requirements
 (1) When binding an authentication level to a digital ID, an ISP must ensure that the authentication level meets each requirement specified in column 2 of the AL Table for the particular authentication level in column 3, 4 or 5 of the AL Table.
 (2) An ISP must not assert an authentication level for a digital ID unless each of the requirements in the AL Table for that authentication level has been met.
 (3) Before authenticating the digital ID of an individual, an ISP must ensure that the authenticator presented by the individual has not expired or been suspended or revoked.
 (4) If the authentication level bound to an individual's digital ID is to be stepped-up to a higher authentication level, the individual must first authenticate to their digital ID using the existing authenticator bound to the digital ID.
 (5) An additional authenticator must not be bound to a digital ID unless the individual has first authenticated at least to the authentication level at which the new authenticator will be used.
 (6) If an ISP issues authenticators that expire, an updated authenticator must be bound to a digital ID in a reasonable amount of time before the authenticator expires.
 (7) When the individual authenticates to their digital ID using the new authenticator, the authenticator being replaced must be immediately revoked.
 (8) If an ISP reasonably suspects that use of a kind of authenticator is, or would, result in an unacceptable risk to an individual, the ISP must as soon as practicable:
 (a) prevent further use of that authenticator;
 (b) notify individuals using that kind of authenticator of the security risk;
 (c) offer affected individuals at least one alternative authenticator at the authenticator level required to be bound to