Skip to main
Help and resources
Register
for My Account
Sign in
to My Account
Search
Australian Government
Federal Register of Legislation
Site navigation
Constitution
Acts
Legislative instruments
Notifiable instruments
Gazettes
Administrative Arrangements
Prerogative instruments
Norfolk Island
Home
Legislative instruments
In force
Text
Details
Authorises
Downloads
All versions
Interactions
Digital ID (Accreditation) Rules 2024
In force
Administered by
Department of Finance
This item is authorised by the following title:
Digital ID Act 2024
Latest version
Order print copy
Save this title to My Account
Set up an alert
F2024L01438
12 November 2024
Legislation text
View document
Select value
Legislative instrument
Explanatory statement
Filter active
Table of contents
Enter text to search the table of contents
Collapse
Chapter 1—Preliminary
1.1 Name
1.2 Commencement
1.3 Authority
1.4 Definitions
1.5 Meaning of taking reasonable steps
1.6 Meaning of authenticated session
1.7 Incorporated instruments
1.8 Application—transitioned accredited entities
1.9 Application—applicants
Collapse
Chapter 2—Applying for accreditation
2.1 DI data environment
2.2 Documents to accompany application
2.3 Criteria to be met
2.4 Privacy impact assessment
2.5 Technical testing
2.6 Matters to which the Digital ID Regulator must have regard
2.7 Matters of which the Digital ID Regulator must be satisfied
Collapse
Chapter 3—Assurance assessments and systems testing
Collapse
Part 3.1—General requirements
3.1 Entity’s obligation
3.2 Assessors
Part 3.2—Assurance assessments
Collapse
Division 1—Protective security assessment
3.3 Requirements
3.4 Essential strategies review and report
3.5 If a control or strategy is not relevant to an accredited entity
3.6 Requirements
Division 3—Accessibility and useability assessment
3.7 Requirements
Part 3.3—Systems testing
Division 1—Penetration testing
3.8 Penetration testing requirements
3.9 Penetration testing assessor
3.10 Penetration testing report
Division 2—Useability testing
3.11 Accessible and inclusive services
3.12 Useability testing requirements
3.13 Useability testing report
Division 3—WCAG testing
3.14 Accessible and inclusive services
3.15 WCAG testing requirements
3.16 WCAG testing report
Part 3.4—Reports for assurance assessments and systems testing
3.17 Assessor’s report
3.18 Entity’s response to an assessor’s report
Collapse
Chapter 4—Requirements for maintaining accreditation
Collapse
Part 4.1—Protective security controls
Collapse
Division 1—Capability
4.1 Protective security capability
Collapse
Division 2—Protective security frameworks
4.2 Accredited entities must implement a security framework
4.3 Compliance with the PSPF
4.4 Compliance with ISO/IEC 27001
4.5 Implementation and compliance with an alternative framework
4.6 If a control is not relevant to an entity
Collapse
Division 3—Additional protective security controls
4.7 Cyber security risk assessment
4.8 Sharing information about risks
4.9 Eligibility and suitability of personnel
4.10 Advice to individuals
4.11 Support to individuals
Collapse
Subdivision A—System security plan
4.12 Requirements for system security plan
4.13 Review of the system security plan
Subdivision B—Cloud service management
4.14 Selection, use and management of cloud services
Subdivision C—Incident detection, investigation, response and reporting
4.15 Incident monitoring and detection
4.16 Incident investigation, management and response
4.17 Disaster recovery and business continuity management
4.18 Record keeping
Subdivision D—Information technology system controls
4.19 Essential Eight
4.20 Logging requirements
4.21 Cryptography
4.22 Cryptographic standards
4.23 Cryptographic key management processes and procedures
Part 4.2—Fraud control requirements
Collapse
Division 1—Capability
4.24 Fraud management capability
Collapse
Division 2—Fraud controls
4.25 Fraud risk assessment
4.26 Sharing information about risks
4.27 Fraud controller
4.28 Fraud awareness training
4.29 Advice to individuals
4.30 Support to individuals
Collapse
Division 3—Fraud control plan
4.31 Fraud control plan
4.32 Review of entity’s fraud control plan
Collapse
Division 4—Incident detection, investigation, response and reporting
4.33 Incident monitoring and detection
4.34 Incident investigation, management and response
4.35 Record keeping
Part 4.3—Privacy
4.36 Privacy governance code
4.37 Compliance with privacy governance code
4.38 Privacy policy
4.39 Review
4.40 Providing information about express consent
4.41 Duration of express consent
4.42 Data minimisation principle
4.43 Disclosure of personal information for fraud activities
4.44 Privacy awareness training
4.45 Data breach response plan
4.46 Record keeping
Part 4.4—Accredited services must be accessible and inclusive
4.47 Application
4.48 Reporting on accessibility
4.49 Accessibility requirements
Part 4.5—Biometric information: testing and fraud activities
4.50 Requirements if biometric information is used for testing activities
4.51 Requirements if biometric information is used for fraud activities
Part 4.6—Review of DI data environment and statement of scope and applicability
4.52 DI data environment
4.53 Statement of scope and applicability
Collapse
Chapter 5—Requirements when providing accredited services
Collapse
Part 5.1—Accredited identity service providers
Collapse
Division 1—Generating, managing, maintaining or verifying a digital ID
5.1 General requirements
5.2 Digital IDs and children
5.3 One-off digital IDs
5.4 Use of a reusable digital ID
5.5 Step-up of an identity proofing level
5.6 Updating and correcting attributes
5.7 Suspending the use of a digital ID
5.8 Digital IDs affected by a fraud or cyber security incident
5.9 Resuming the use of a digital ID
Collapse
Division 2—Identity proofing and use of credentials
Collapse
Subdivision A—Identity proofing
5.10 IP Levels Table
5.11 Verification using an Australian passport
5.12 Technical verification of credentials
5.13 Source verification using non-government credentials
5.14 Visual verification
Collapse
Subdivision B—Verification using biometric information
5.15 Application
5.16 Requirements for biometric binding
5.17 Requirements for online biometric binding
5.18 Requirements for local biometric binding
5.19 Requirements for technical biometric matching
5.20 eIDVT biometric matching
5.21 Requirements for manual face comparison
Collapse
Subdivision C—Alternative proofing processes
5.22 Accessible and inclusive services
5.23 Requirements for an alternative proofing process
Collapse
Division 3—Generating, binding, managing or distributing authenticators
5.24 General requirements
5.25 Physical authenticators
5.26 Authenticator that has been compromised
5.27 Expired and renewed authenticators
5.28 Revocation and termination of an authenticator
Collapse
Division 4—Accessibility and useability
5.29 Application
5.30 Verification services
5.31 Authentication services
Collapse
Part 5.2—Accredited attribute service providers
5.32 Verifying and managing a special attribute
5.33 Requirements when verifying a special attribute
5.34 Special attributes that are self-asserted
5.35 Special attributes affected by a fraud or cyber security incident
Collapse
Part 5.3—Accredited identity exchange providers
5.36 General requirements
5.37 Digital ID system rules
Collapse
Chapter 6—Annual reviews
Collapse
Part 6.1—Accredited entities to conduct annual reviews
6.1 General requirements
6.2 Reporting periods
6.3 Scope of annual review
6.4 Assurance assessments
6.5 Penetration and presentation attack detection testing
Collapse
Part 6.2—Accredited entities to provide annual reports
6.6 Content of annual report
6.7 If previous timeframes to address risks and recommendations not met
6.8 Information and documents
6.9 Attestation statement
Collapse
Chapter 7—Other matters relating to accreditation
Collapse
Part 7.1—Matters related to attributes
7.1 Individuals must expressly consent to disclosure of certain attributes of individuals to relying parties
7.2 Meaning of restricted attribute of an individual
Collapse
Part 7.2—Accreditation conditions
7.3 Table of accreditation conditions
Collapse
Part 7.3—Reportable incidents
7.4 Reportable incidents
7.5 Change of control for corporations
7.6 Entity no longer providing accredited services
Collapse
Part 7.4—Data standards relating to accreditation
7.7 Digital ID Data Standards Chair to make standards
Collapse
Part 7.5—Record keeping
7.8 General record keeping requirement
Schedule 1—Documents or other credentials that are a commencement of identity credential
Schedule 2—Documents or other credentials that are a linking credential
Schedule 3—Documents or other credentials that are a UitC credential
Schedule 4—Documents or other credentials that are a photo ID
Schedule 5—PSPF controls