1.1
Name
1.1 Name
These rules are the Digital ID (Accreditation) Rules 2024.
//
© 2026 Zoe. All rights reserved.
Zoe is a legal information platform. Always consult the Federal Register of Legislation for authoritative text.
Commonwealth legislation
These rules set detailed accreditation requirements for organisations seeking to provide digital ID services under Australia’s Digital ID Act 2024. They apply to Identity Service Providers, Attribute Service Providers and Identity Exchange Providers, imposing security and privacy frameworks, biometric and accessibility controls, identity‑proofing levels, lifecycle and breach-response obligations, and a prohibition on IDs for under‑15s.
They matter because they define the operational, security and privacy safeguards that underpin trusted, interoperable digital identity services.
Want the full deep dive?
Zoe can write the in-depth analysis on top of the summary above: how it works, who it affects and what each part actually does.
Direct links to the current provisions in Digital ID (Accreditation) Rules 2024.
These rules are the Digital ID (Accreditation) Rules 2024.
These rules are made under section 168 of the Digital ID Act 2024 for the purposes of the provisions in the Act in which the term ‘Accreditation Rules’ occurs.
Note: A number of expressions used in these rules are defined in the Act, including the following:
(a) accredited entity;
(b) attribute;
(c) digital ID;
(d) participating relying party;
(e) personal information.
Note 2: A number of expressions used in these rules are defined in the Accreditation Data Standards, including the following:
(a) AL Table;
(b) authentication level;
(c) in‑device biometric capability;
(d) out‑of‑band device.
(1) Expressions defined in the Accreditation Data Standards have the same meaning in these rules. (2) In these rules:
accessibility and useability assessment means an assessment conducted in accordance with rule 3.7.
accountable executive, of an entity, means a senior executive of the entity responsible for the overall management of the entity’s DI data environment, proposed accredited services and accredited services.
Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.
acquired image means an image of an individual’s face that is used as a sample for biometric matching against the corresponding image from the individual’s photo ID.
ACSC means the Australian Cyber Security Centre.
Act means the Digital ID Act 2024.
alternative proofing process: see rule 5.22.
annual review: see rule 6.1.
applicant: see rule 1.9.
approved cryptography means:
(a) Australian Signals Directorate Approved Cryptographic Algorithms; and
(b) Australian Signals Directorate Approved Cryptographic Protocols,
as each is defined either in the ISM or the document Implementing Certificates, TLS, HTTPS and Opportunistic TLS published by the Australian Signals Directorate.
Note: At the time these rules were made, located at https://www.cyber.gov.au/sites/default/files/2023‑03/PROTECT%20‑%20Implementing%20Certificates%2C%20TLS%2C%20HTTPS%20and%20Opportunistic%20TLS%20%28October%202021%29.pdf.
ASP means an accredited attribute service provider.
assessing officer means a member of personnel of an applicant or accredited entity who is trained and authorised by that entity to conduct local biometric binding or manual face comparison.
assessor: see rule 3.2.
assessor’s report: see rule 3.17.
assurance assessment means a protective security assessment, fraud assessment or accessibility and useability assessment.
Australian passport has the same meaning as in the Australian Passports Act 2005.
authoritative source means a person that issues documents or other credentials containing information about an individual.
biometric binding means the process of confirming the link between an individual and a photo ID by conducting biometric matching for the purpose of obtaining IP2 Plus, IP3 or IP4.
Note: See item 4 of the IP Levels Table.
biometric capability, in relation to an applicant or accredited entity, means the components of the entity’s DI data environment that process or are involved in the processing of biometric information (including for biometric binding and biometric matching).
biometric matching means one‑to‑one comparison of an individual against the image on their photo ID.
biometric matching algorithm means the algorithm used to conduct biometric matching.
commencement of identity credential or CoI credential means a document or other credential listed in Schedule 1.
Note: A commencement of identity credential evidences an individual’s commencement of identity in Australia.
cryptographic key means a string of characters used with approved cryptography to encrypt and decrypt.
cyber security risk means the risk of a cyber security incident occurring in relation to an entity’s DI data environment, proposed accredited services or accredited services.
cyber security risk assessment: see rule 4.7.
data breach means loss or misuse of, unauthorised access to, or unauthorised modification or disclosure of, personal information held by an applicant or accredited entity.
DI data environment means digital ID data environment.
digital ID data environment means the information technology systems used for, and the processes that relate to:
(a) for an applicant—the provision of the entity’s proposed accredited services; or
(b) for an accredited entity—the entity’s accredited services.
Digital ID Rules means the Digital ID Rules 2024.
eIDVT means electronic identity document verification technology that uses non‑cryptographic techniques to classify physical documents or other credentials submitted online by an individual as being genuine or not genuine.
eIDVT biometric matching means biometric matching that uses a facial image acquired from a photo ID that has been classified as a genuine document by eIDVT to match against an acquired image.
ePassport means a travel document size 3 machine readable travel document conforming to the specifications of Part 4 of the ICAO Doc 9303 Standard that additionally incorporates a contactless integrated circuit.
fraud assessment means an assessment conducted in accordance with rule 3.6.
fraud control plan: see rule 4.31.
fraud controller: see rule 4.27.
fraud management capability: see rule 4.24.
fraud risk means the risk of a digital ID fraud incident occurring.
fraud risk assessment: see rule 4.25.
hold: an entity holds personal information if the entity has possession or control of a record that contains the personal information.
ICAO Doc 9303 Standard means the standard for machine readable travel documents published by the International Civil Aviation Organisation.
Note: At the time these rules were made, located at https://www.icao.int/publications/pages/publication.aspx?docnum=9303.
identity proofing means the process to verify an attribute of an individual to generate, manage or maintain the digital ID of the individual.
identity proofing level or IP level means a level specified in the first row of the IP Levels Table.
image quality profile means the profile that captured biometric information is compared against to ensure that it meets a threshold for information quality before being used for biometric binding or authentication.
IP Levels Table means the table in rule 5.10.
ISM means the Australian Government Information Security Manual published by the ACSC.
Note: At the time these rules were made, located at https://www.cyber.gov.au/resources‑business‑and‑government/essential‑cyber‑security/ism).
ISO/IEC 29794‑5 means Part 5 (concerning face image data) of the series of standards designated ISO/IEC 29794 (concerning biometric sample quality), published by the International Organization for Standardization.
Note: At the time this instrument was made, the current version was ISO/IEC TR 29794‑5:2010, located at https://www.iso.org/standard/50912.html.
ISO/IEC 27001 means the standard for information security management systems, published by the International Organization for Standardization.
Note: At the time this instrument was made, the current version was ISO/IEC 27001:2022, located at https://www.iso.org/standard/27001.
ISO/IEC 30107‑1 means Part 1 (concerning framework) of the series of standards designated ISO/IEC 30107 (concerning biometric presentation attack detection), published by the International Organization for Standardization.
Note: At the time this instrument was made, the current version was ISO/IEC 30107‑1:2023, located at https://www.iso.org/standard/83828.html.
ISO/IEC 24745 means the standard for information security, cybersecurity and privacy protection, published by the International Organization for Standardization
Note: At the time this instrument was made, the current version was ISO/IEC 24745:2022, located at https://www.iso.org/standard/75302.html.
ISP means an accredited identity service provider.
IXP means an accredited identity exchange provider.
linking credential means a document or other credential listed in Schedule 2.
Note: A linking credential demonstrates the continuity of the individual’s verified identity if that individual’s attributes have changed.
liveness detection means the measurement and analysis of biometric, biological and behavioural characteristics or involuntary or voluntary reactions of the live presentation of an individual, in order to determine if a biometric sample is being captured from a living individual who is physically present at the place and time when the biometric sample is captured.
local biometric binding means biometric binding conducted by and in the physical presence of an entity’s assessing officer.
manual face comparison means the process of using visual verification to compare the likeness of an individual to the individual’s claimed photo ID, conducted by, and in the physical presence of, an entity’s assessing officer.
material change, in relation to an entity, means any change that alone or cumulatively results in, or is reasonably likely to result in:
(a) a material or adverse impact on the entity’s DI data environment, proposed accredited services or accredited services; or
(b) an adverse impact on the entity’s ability to comply with the Act, these rules or the Accreditation Data Standards.
Note: The definition of ‘material change’ in these rules is different to the definition of the same expression in the Digital ID Rules.
non‑corporate Commonwealth entity has the same meaning as in the Public Governance, Performance and Accountability Act 2013.
online biometric binding means biometric binding conducted remotely via unsupervised data capture processes conducted across the internet.
penetration testing means testing conducted in accordance with Division 1 of Part 3.3 of Chapter 3.
personnel, of an entity, means:
(a) an employee of the entity; or
(b) an individual who, under a labour hire, consultancy or similar arrangement with the entity, performs work for the entity in relation to its proposed accredited services or accredited services.
photo ID means a document or other credential listed in Schedule 4.
physical authenticator: see rule 5.25.
presentation attack means the presentation of an artefact to a biometric data capture subsystem with the goal of interfering with the expected operation of the biometric capability.
presentation attack detection means automated discrimination between bona‑fide presentations and presentation attacks.
presentation attack instrument means an object or biometric characteristic that is used in a presentation attack.
Privacy Act means the Privacy Act 1988.
proposed accredited services, in relation to an applicant, means the services proposed to be provided by the entity in its application under section 14 of the Act for accreditation as an accredited entity.
protective security assessment means an assessment conducted in accordance with Division 1 of Part 3.2 of Chapter 3.
protective security capability: see Division 1 of Part 4.1 of Chapter 4.
protective security framework means:
(a) the PSPF; or
(b) ISO/IEC 27001; or
(c) an alternative framework (see rule 4.5).
protective security framework control means:
(a) a relevant PSPF control; or
(b) a control specified in ISO/IEC 27001; or
(c) a control specified in an alternative framework (see rule 4.5).
PSPF means the Protective Security Policy Framework published by the Australian Government.
Note 1: The PSPF could in 2025 be accessed at https://www.protectivesecurity.gov.au.
Note 2: At the time subrule 1.7(2) commenced, the current version of the PSPF was the PSPF published on 24 July 2025.
public‑facing proposed accredited services, in relation to an applicant, means the proposed accredited services or elements of the entity’s information technology system that an individual directly interacts with when using, or attempting to use, the entity’s proposed accredited services.
public‑facing accredited services, in relation to an accredited entity, means the accredited services or elements of the entity’s information technology system that an individual directly interacts with when using, or attempting to use, the entity’s accredited services.
Note: Example: An example of public‑facing accredited services is where an individual provides information to be verified via an ISP’s mobile app that the individual is required to download so as to access the entity’s accredited services.
public‑facing information related to proposed accredited services, in relation to an applicant, means information made available by the entity to individuals when interacting with the entity’s public‑facing proposed accredited services.
public‑facing information related to accredited services, in relation to an accredited entity, means information made available by the entity to individuals when interacting with the entity’s public‑facing accredited services.
Note: Example: Public‑facing information related to accredited services is the accredited entity’s privacy policy made available to individuals.
relevant PSPF control: see rule 4.3.
reporting period, for an accredited entity: see rule 6.1.
Note: Chapter 6 requires an accredited entity to conduct an annual review, and report on that review, in each 12‑month reporting period.
reusable digital ID means a digital ID verified for multiple uses by binding an authenticator to the digital ID.
risk assessment means the systematic, iterative and collaborative process of identification, analysis and evaluation of risk.
source biometric matching means the process of using source verification to verify that an acquired image biometrically matches the image on the document or other credential held by the authoritative source.
source verification means the process of verifying an attribute of an individual or a document or other credential in relation to the individual:
(a) with the authoritative source for that attribute or document or other credential; or
(b) through information provided by a service that confirms the veracity of the attribute or document or other credential with an authoritative source.
Note: A service that confirms the veracity of information includes a DVS or FVS (within the meaning of those terms in the Identity Verification Services Act 2023).
special attribute: see rule 5.32.
Note: An ASP is accredited to verify and manage a special attribute of an individual such as an authorisation for, or qualification of, an individual.
statement of scope and applicability means a statement that lists:
(a) for an applicant:
(i) each requirement in these rules and the Accreditation Data Standards with which the entity must comply in relation to its proposed accredited services if accredited; and
(ii) the evidence that demonstrates the entity will comply with those requirements if accredited; or
(b) for an accredited entity:
(i) each requirement in these rules and the Accreditation Data Standards with which the entity must comply in relation to its accredited services; and
(ii) the evidence that demonstrates the entity complies with those requirements.
system security plan: see rule 4.12.
systems testing means penetration testing, useability testing or WCAG testing.
taking reasonable steps: see rule 1.5.
technical biometric matching means the process of verifying that an acquired image biometrically matches the image of the individual on the document or credential, where the document or credential and the image have been verified using technical verification.
technical testing means testing of information technology systems by executing the user flows, user interactions and component interactions.
technical verification means the process of verifying, via public key infrastructure technology, physical or electronic documents or other credentials using approved cryptography.
transitioned accredited entity means an entity taken to be accredited immediately after commencement of the Act in accordance with item 2 of Schedule 1 to the Digital ID (Transitional and Consequential Provisions) Act 2024.
UitC credential means a document or other credential listed in Schedule 3.
Note: A UitC credential evidences an individual’s use in the Australian community of the individual’s identity.
useability testing means testing conducted in accordance with Division 2 of Part 3.3 of Chapter 3.
visa has the same meaning as in the Migration Act 1958 and includes an entry permit (within the meaning of that term in the Migration Act 1958 as in force immediately before 1 September 1994).
visual verification means visually confirming that a document or other credential presented by an individual in‑person, and information on that document or other credential, is legitimate.
WCAG means the Web Content Accessibility Guidelines version 2.1 published by the World Wide Web Consortium.
Note: At the time these rules were made, located at https://www.w3.org/TR/WCAG21/. World Wide Web Consortium is commonly known as ‘W3C’.
WCAG testing means testing conducted in accordance with Division 3 of Part 3.3 of Chapter 3.
In these rules, taking reasonable steps, in relation to a duty to ensure an identified outcome, means taking steps that are, or were at a particular time, reasonably able to be done in relation to ensuring that outcome, taking into account and weighing up all relevant matters including: (a) the likelihood of risks to achievement of the outcome occurring; (b) the degree of harm that might result if the outcome is not achieved; (c) what the person who has the duty knows, or ought reasonably to know, about: (i) the risks to achievement of the outcome; and (ii) ways of eliminating or minimising the risks; (d) the availability and suitability of ways to eliminate or minimise the risks; and (e) after assessing the extent of the risks and the available ways of eliminating or minimising them, the cost associated with available ways of eliminating or minimising the risks, including whether the cost is grossly disproportionate to the risks.
For the purposes of subsection 56(3) of the Act:
authenticated session means a persistent interaction between 2 entities involved in a transaction in a digital ID system which begins with an authentication event and ends with an event that brings the authenticated session to an end.
Note: The session could terminate after a specific period, or on the occurrence of a specific event such as the individual closing the browser or logging out.
authentication event means the process of an individual using their authenticator to verify that they are the valid user of a digital ID.
(1) If a provision of these rules incorporates or applies, with or without modification, matters contained in any other instrument or other writing (incorporated instrument), then, unless the contrary intention appears in the provision, the reference to the incorporated instrument is a reference to the incorporated instrument as in force or existing from time to time. (2) Unless the contrary intention appears in these rules, an accredited entity is not required to comply with: (a) a change to the PSPF made after this subrule commences until 3 months after that change has taken effect; and (b) a change to any other incorporated instrument until 12 months after that change to the incorporated instrument has taken effect.
Note 1: See subsection 167(3) of the Act.
Note 2: At the time this subrule commenced, the current version of the PSPF was the PSPF published on 24 July 2025.
(3) Subrule (2) does not apply if the incorporated instrument is an Act or a legislative instrument.
For the purposes of the incorporation or application of the PSPF by these rules, the PSPF is subject to the following modifications: (a) a reference to Australian Government resources or Australian Government people and resources in the PSPF is taken to be a reference to DI data environment (within the meaning of these rules); (b) a reference to risk in the PSPF is taken to be a reference to cyber security risk (within the meaning of these rules).
For the purposes of the incorporation or application of ISO/IEC 27001 by these rules, that standard is subject to the following modifications: (a) a reference to Personally Identifiable Information in the standard is taken to be a reference to personal information (within the meaning of the Act); (b) a reference to information security incident in the standard is taken to be a reference to cyber security incident (within the meaning of the Act); (c) a reference to information security risk in the standard is taken to be a reference to cyber security risk (within the meaning of these rules).
(1) A provision in column 1 of an item in the following table applies to a transitioned accredited entity on and after 30 November 2025, subject to the exception (if any) in column 2 of that item.
<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="3" style="width:415.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Application of these rules to transitioned accredited entities</span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p></td></tr><tr><td style="width:41.85pt; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span></span></p></td><td style="width:141.25pt; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Provision</span></p></td><td style="width:210.95pt; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Exception</span></p></td></tr></thead><tbody><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>rule 4.14</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>2</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>rule 4.19</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>3</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>subrules 4.20(3) and (4)</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>4</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>paragraph 4.22(2)(b)</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>5</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>subrule 4.38(3)</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>The requirements in relation to privacy policies in this subrule apply to a transitioned accredited entity on and from the commencement of these rules.</span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>6</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>subrule 4.41(3)</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>7</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>subrule 4.42(2)</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>8</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>paragraph 4.50(3)(c) and subrules</span><span> </span><span>4.50(4), (5) and (6)</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>9</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>rule 4.51</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr><tr><td style="width:41.85pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>10</span></p></td><td style="width:141.25pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>rule</span><span> </span><span>5.2</span></p></td><td style="width:210.95pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span></span></p></td></tr></tbody></table>
(1A) Rule 5.7 and subrule 5.9(2) apply to a transitioned accredited entity on and after 30 November 2026. (2) Every provision of these rules not specified in subrules (1) or (1A) applies to a transitioned accredited entity in accordance with its terms and on and from the commencement of these rules.
(1) These rules apply to an entity (an applicant): (a) that has made an application under section 14 of the Act for accreditation as an accredited entity; and (b) at the time the entity applies for such accreditation. (2) These rules apply to, and in relation to, an applicant with the modifications in this rule. (3) If, because of Chapter 2 and subrule (4): (a) an applicant is required to implement any measure in accordance with, or comply with, a provision in Chapter 3, 4 or 5 of these rules, or a provision in the Act or Accreditation Data Standards—the applicant must implement that measure in accordance with, or comply with, that provision as if the applicant is an accredited entity that is accredited to provide its proposed accredited services; and (b) the ability or capacity of an applicant to implement any measure in accordance with, or comply with, a provision in Chapter 3, 4 or 5 of these rules, or a provision in the Act or Accreditation Data Standards, is to be assessed—the assessment is to be undertaken as if the applicant were an accredited entity that is accredited to provide its proposed accredited services. (4) For the purposes of Chapter 2, an expression in column 1 of an item in the following table that appears in Chapter 3, 4 or 5 of these rules, or in a provision of the Act or Accreditation Data Standards, applies to, or in relation to, an applicant subject to the modification in column 2 of that item.
<table cellspacing="0" cellpadding="0" style="width:100%; border-collapse:collapse"><thead><tr><td colspan="3" style="width:343.55pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Application of these rules to applicants</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Item</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 1</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Column 2</span></p></td></tr><tr><td style="width:24.65pt; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span></span></p></td><td style="width:116.8pt; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Expression</span></p></td><td style="width:180.5pt; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="TableHeading"><span>Modification</span></p></td></tr></thead><tbody><tr><td style="width:24.65pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>1</span></p></td><td style="width:116.8pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>accredited entity</span></p></td><td style="width:180.5pt; border-top:1.5pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to an applicant.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>2</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>accredited services</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to proposed accredited services.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>3</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>ASP</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to an applicant who has applied to be an ASP.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>4</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>digital ID fraud incident</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken to include an act, event or circumstance that occurs in connection with a proposed accredited service of an applicant and results in any of the circumstances in paragraph (b) of the definition of ‘digital ID fraud incident’ in section</span><span> </span><span>9 of the</span><span> </span><span>Act.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>5</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>ISP</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to an applicant who has applied to be an ISP.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>6</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>IXP</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to an applicant who has applied to be an IXP.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>7</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>public</span><span>‑</span><span>facing accredited services</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:0.75pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to public</span><span>‑</span><span>facing proposed accredited services.</span></p></td></tr><tr><td style="width:24.65pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>8</span></p></td><td style="width:116.8pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>public</span><span>‑</span><span>facing information related to accredited services</span></p></td><td style="width:180.5pt; border-top:0.75pt solid #000000; border-bottom:1.5pt solid #000000; padding-right:5.4pt; padding-left:5.4pt; vertical-align:top"><p class="Tabletext"><span>to be taken as a reference to public</span><span>‑</span><span>facing information related to proposed accredited services.</span></p></td></tr></tbody></table>
Chapter 2—Applying for accreditation
For the purposes of paragraph 15(4)(d) of the Act, the Digital ID Regulator must not accredit an applicant unless the Regulator is satisfied that the applicant: (a) has correctly identified, defined and documented the boundaries of its DI data environment, including: (i) the people, processes, technology and infrastructure that will manage, secure, store or otherwise interact with the information generated, collected, used, held or disclosed for the purpose of providing its accredited services, if the applicant is accredited; and (ii) the infrastructure owned by, and management provided by, any contractor engaged, or proposed to be engaged, by the applicant to provide a proposed accredited service, or part of a proposed accredited service, if the applicant is accredited; (b) has limited the boundaries of its DI data environment to the extent practicable, including by: (i) segregating the environment from other systems; (ii) minimising the number of people who interact with the information referred to in paragraph (a); (iii) limiting the number of systems hosting, processing or accessing the information referred to in paragraph (a); and (iv) minimising the use of contracted service providers interacting with the information referred to in paragraph (a).
For the purposes of paragraph 141(1)(c) of the Act, an application made by an applicant must be accompanied by: (a) a statement of scope and applicability; and (b) a statement, signed by the applicant’s accountable executive, attesting that: (i) the technical testing required by rule 2.5 has been conducted; (ii) the accountable executive is satisfied the results of the technical testing demonstrate that the requirements listed in subrule 2.5(2) are met; and (iii) if a cloud service provider has conducted penetration testing as required by paragraph 3.8(4)(a)—the applicant is satisfied that that penetration testing covers the kinds of penetration testing in subrule 3.8(2); and (c) for biometric testing conducted as required by paragraph 2.3(3)(e), copy of reports of the testing and any required responses to the reports.
Note: An approved form for an application may require additional information and documents to be provided (see section 141 of the Act).
(1) An applicant must meet the criteria in this rule. (2) At the time an applicant applies for accreditation, the information technology system through which it will provide its accredited services if accredited must be operational. (3) The applicant must, at the time it applies for accreditation, have conducted: (a) assurance assessments in accordance with Chapter 3; (b) systems testing in accordance with Chapter 3; (c) a privacy impact assessment in accordance with rule 2.4; (d) technical testing in accordance with rule 2.5; (e) if the applicant will conduct biometric binding if accredited—biometric testing in accordance with the Accreditation Data Standards; (f) a cyber security risk assessment in accordance with rule 4.7; and (g) a fraud risk assessment in accordance with rule 4.25.
(1) The applicant must, at the time it applies for accreditation, have conducted a privacy impact assessment in accordance with this rule. (2) The privacy impact assessment must: (a) assess the privacy impacts of: (i) the applicant’s DI data environment and the boundaries of that environment as identified, defined, documented and limited in accordance with rule 2.1; and (ii) the applicant’s proposed accredited services; (b) be conducted by a person who: (i) has appropriate experience, training and qualifications to conduct a privacy impact assessment; (ii) is external to the applicant and, if the applicant is part of a corporate group, external to the group; and (iii) is not, and has not, been involved in the design, implementation, operation or management of the applicant’s proposed accredited services or DI data environment; and (c) include: (i) details of the flow of personal information into, within and from the applicant’s DI data environment; (ii) an assessment of the relevant documentation, processes and mechanisms to facilitate the applicant’s compliance with the privacy requirements specified in Chapter 3 of the Act and Part 4.3 of Chapter 4 of these rules; (iii) an analysis of how the applicant’s provision of its proposed accredited services will impact the privacy of individuals and protection of personal information, if the applicant is accredited, including how the applicant will comply with any applicable requirements in Chapter 5 of these rules and the Accreditation Data Standards; (iv) an analysis of whether any privacy risks or impacts identified in the privacy impact assessment are necessary or unavoidable; (v) any recommendations made by the person who conducted the assessment, including recommendations that the applicant undertake activities to mitigate any identified privacy risks; (vi) whether any recommendations of the person who conducted the privacy impact assessment to mitigate any privacy risks or impacts have been accepted and, if not, why actions to address such risks or recommendations are not necessary; and (vii) details of consultation with relevant stakeholders. (3) The applicant must respond in writing to the findings of the privacy impact assessment. (4) The applicant’s response to the privacy impact assessment must be signed by the applicant’s accountable executive. (5) For each risk or recommendation identified by the privacy impact assessment, the applicant must: (a) develop a risk matrix based on an established risk management framework or standard; (b) conduct a risk assessment; (c) assign a risk rating in accordance with the risk matrix developed in accordance with paragraph (a); (d) respond to each risk identified in the report with actions it will take to address the risk; and (e) respond to each recommendation in the assessment. (6) The applicant’s response to each risk needing to be addressed and each recommendation must include: (a) for each risk or recommendation that the applicant will address: (i) details of the action the applicant will take to address the risk or recommendation; (ii) the timeframe in which the applicant will complete the action, having regard to the risk rating assigned for the risk or recommendation; and (iii) the residual risk rating expected following completion of the action; and (b) for each risk and recommendation that the applicant will not address: (i) the reasons for the applicant’s decision not to address the risk; (ii) details of alternative actions, if any, to be taken by the applicant; and (iii) the residual risk rating expected following completion of any alternative action.
(1) The applicant must, at the time it applies for accreditation, have conducted technical testing in accordance with this rule. (2) The technical testing of the information technology system through which the applicant will provide its accredited services must determine whether the system has the functionality necessary to meet the following requirements: (a) incident monitoring, detection, investigation, management and response for cyber security incidents as required by Subdivision C of Division 3 of Part 4.1 of Chapter 4; (b) logging requirements as required by rule 4.20; (c) incident monitoring, detection, investigation, management and response for fraud incidents as required by Division D of Part 4.2 of Chapter 4; (d) support to individuals as required by rules 4.11 and 4.30; (e) data minimisation requirements, as required by subrule 4.42(2); and (f) compliance with the Accreditation Data Standards that are specific to the kind of accredited services the applicant will provide if accredited. (3) The applicant must record in respect of the technical testing conducted: (a) the test completion criteria used; (b) the assumptions, limitations and dependencies used; (c) the methodology used, including a description of the data and environment used to conduct the testing; (d) how each test maps to each requirement referred to in subrule (2); and (e) the results of the technical testing, including details of any failure to meet the requirements in subrule (2) that is identified and how this failure has been addressed.
(1) For the purposes of paragraph 15(5)(a) of the Act, in deciding whether to accredit an applicant, the Digital ID Regulator must have regard to the following matters: (a) the level of the applicant’s tolerance of fraud risks and whether the level is likely to create an unacceptable risk in respect of the proposed accredited services to be provided by the entity if accredited; (b) the level of the applicant’s tolerance of cyber security risks and whether the level is likely to create an unacceptable risk in respect of the proposed accredited services to be provided by the entity if accredited; and (c) whether the applicant’s privacy impact assessment and the applicant’s response to that assessment identify any matters that may give rise to an unacceptable risk to the privacy of individuals. (2) This rule is not limited by paragraph 1.9(3)(b).
(1) For the purposes of paragraph 15(4)(d) of the Act, the Digital ID Regulator must not accredit an applicant unless it is satisfied that the information and documents provided by the applicant demonstrate that the applicant, if accredited, will be able to comply with: (a) the Act; (b) these rules; and (c) the Accreditation Data Standards, to the extent a standard relates to a particular activity to be conducted by the applicant.
Note: Accredited entities must comply with the Accreditation Data Standards applicable to the accredited service being provided and the manner of providing that service (see subparagraph 5.1(1)(a)(ii)).
(2) This rule is not limited by paragraph 1.9(3)(b).
Chapter 3—Assurance assessments and systems testing
(1) If an accredited entity is required by a provision of these rules to conduct an assurance assessment or systems testing, the entity must ensure: (a) the process for the assurance assessment or systems testing complies with the requirements of this Chapter; and (b) the elements of the DI data environment that are being assessed or tested meet the requirements of the Act and these rules relevant to the kind of assurance assessment or systems testing being conducted.
Note: Applicants are required to conduct assurance assessments and systems testing for their application for accreditation (see subrule 2.3(3)). Accredited entities are required, in accordance with Chapter 6, to conduct assurance assessments and systems testing for annual reviews.
(2) Each assurance assessment and systems testing must be conducted: (a) having regard to the requirements with which the accredited entity must comply as detailed in the entity’s statement of scope and applicability; and (b) in respect of the entity’s DI data environment, as at the time the assurance assessment or systems testing is conducted.
(1) An assurance assessment and systems testing must be conducted by an individual (assessor): (a) who has appropriate experience, training and qualifications to conduct that kind of assessment or systems testing; and (b) if additional requirements relating to the assessor are specified in these rules for that kind of assurance assessment or systems testing—who meets those requirements. (2) If requested by the assessor, an accredited entity must take reasonable steps: (a) to permit the assessor to have secure online access to documentation and information relevant to the assurance assessment or systems testing; and (b) to undertake a site visit to the entity’s premises or other location at which the accredited services are, or will be, provided.
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
These rules are the Digital ID (Accreditation) Rules 2024.
These rules are made under section 168 of the Digital ID Act 2024 for the purposes of the provisions in the Act in which the term ‘Accreditation Rules’ occurs.
Note: A number of expressions used in these rules are defined in the Act, including the following:
(a) accredited entity;
(b) attribute;
(c) digital ID;
(d) participating relying party;
(e) personal information.
Note 2: A number of expressions used in these rules are defined in the Accreditation Data Standards, including the following:
(a) AL Table;
(b) authentication level;
(c) in‑device biometric capability;
(d) out‑of‑band device.
(1) Expressions defined in the Accreditation Data Standards have the same meaning in these rules. (2) In these rules:
accessibility and useability assessment means an assessment conducted in accordance with rule 3.7.
accountable executive, of an entity, means a senior executive of the entity responsible for the overall management of the entity’s DI data environment, proposed accredited services and accredited services.
Accreditation Data Standards means the Digital ID (Accreditation) Data Standards 2024.
acquired image means an image of an individual’s face that is used as a sample for biometric matching against the corresponding image from the individual’s photo ID.
ACSC means the Australian Cyber Security Centre.
Act means the Digital ID Act 2024.
alternative proofing process: see rule 5.22.
annual review: see rule 6.1.
applicant: see rule 1.9.
approved cryptography means:
(a) Australian Signals Directorate Approved Cryptographic Algorithms; and
(b) Australian Signals Directorate Approved Cryptographic Protocols,
as each is defined either in the ISM or the document Implementing Certificates, TLS, HTTPS and Opportunistic TLS published by the Australian Signals Directorate.
Note: At the time these rules were made, located at https://www.cyber.gov.au/sites/default/files/2023‑03/PROTECT%20‑%20Implementing%20Certificates%2C%20TLS%2C%20HTTPS%20and%20Opportunistic%20TLS%20%28October%202021%29.pdf.
ASP means an accredited attribute service provider.
assessing officer means a member of personnel of an applicant or accredited entity who is trained and authorised by that entity to conduct local biometric binding or manual face comparison.
assessor: see rule 3.2.
assessor’s report: see rule 3.17.
assurance assessment means a protective security assessment, fraud assessment or accessibility and useability assessment.
Australian passport has the same meaning as in the Australian Passports Act 2005.
authoritative source means a person that issues documents or other credentials containing information about an individual.
biometric binding means the process of confirming the link between an individual and a photo ID by conducting biometric matching for the purpose of obtaining IP2 Plus, IP3 or IP4.
Note: See item 4 of the IP Levels Table.
biometric capability, in relation to an applicant or accredited entity, means the components of the entity’s DI data environment that process or are involved in the processing of biometric information (including for biometric binding and biometric matching).
biometric matching means one‑to‑one comparison of an individual against the image on their photo ID.
biometric matching algorithm means the algorithm used to conduct biometric matching.
commencement of identity credential or CoI credential means a document or other credential listed in Schedule 1.
Note: A commencement of identity credential evidences an individual’s commencement of identity in Australia.
cryptographic key means a string of characters used with approved cryptography to encrypt and decrypt.
cyber security risk means the risk of a cyber security incident occurring in relation to an entity’s DI data environment, proposed accredited services or accredited services.
cyber security risk assessment: see rule 4.7.
data breach means loss or misuse of, unauthorised access to, or unauthorised modification or disclosure of, personal information held by an applicant or accredited entity.
DI data environment means digital ID data environment.
digital ID data environment means the information technology systems used for, and the processes that relate to:
(a) for an applicant—the provision of the entity’s proposed accredited services; or
(b) for an accredited entity—the entity’s accredited services.
Digital ID Rules means the Digital ID Rules 2024.
eIDVT means electronic identity document verification technology that uses non‑cryptographic techniques to classify physical documents or other credentials submitted online by an individual as being genuine or not genuine.
eIDVT biometric matching means biometric matching that uses a facial image acquired from a photo ID that has been classified as a genuine document by eIDVT to match against an acquired image.
ePassport means a travel document size 3 machine readable travel document conforming to the specifications of Part 4 of the ICAO Doc 9303 Standard that additionally incorporates a contactless integrated circuit.
fraud assessment means an assessment conducted in accordance with rule 3.6.
fraud control plan: see rule 4.31.
fraud controller: see rule 4.27.
fraud management capability: see rule 4.24.
fraud risk means the risk of a digital ID fraud incident occurring.
fraud risk assessment: see rule 4.25.
hold: an entity holds personal information if the entity has possession or control of a record that contains the personal information.
ICAO Doc 9303 Standard means the standard for machine readable travel documents published by the International Civil Aviation Organisation.
Note: At the time these rules were made, located at https://www.icao.int/publications/pages/publication.aspx?docnum=9303.
identity proofing means the process to verify an attribute of an individual to generate, manage or maintain the digital ID of the individual.
identity proofing level or IP level means a level specified in the first row of the IP Levels Table.
image quality profile means the profile that captured biometric information is compared against to ensure that it meets a threshold for information quality before being used for biometric binding or authentication.
IP Levels Table means the table in rule 5.10.
ISM means the Australian Government Information Security Manual published by the ACSC.
Note: At the time these rules were made, located at https://www.cyber.gov.au/resources‑business‑and‑government/essential‑cyber‑security/ism).
ISO/IEC 29794‑5 means Part 5 (concerning face image data) of the series of standards designated ISO/IEC 29794 (concerning biometric sample quality), published by the International Organization for Standardization.
Note: At the time this instrument was made, the current version was ISO/IEC TR 29794‑5:2010, located at https://www.iso.org/standard/50912.html.
ISO/IEC 27001 means the standard for information security management systems, published by the International Organization for Standardization.
Note: At the time this instrument was made, the current version was ISO/IEC 27001:2022, located at https://www.iso.org/standard/27001.
ISO/IEC 30107‑1 means Part 1 (concerning framework) of the series of standards designated ISO/IEC 30107 (concerning biometric presentation attack detection), published by the International Organization for Standardization.
Note: At the time this instrument was made, the current version was ISO/IEC 30107‑1:2023, located at https://www.iso.org/standard/83828.html.
ISO/IEC 24745 means the standard for information security, cybersecurity and privacy protection, published by the International Organization for Standardization
Note: At the time this instrument was made, the current version was ISO/IEC 24745:2022, located at https://www.iso.org/standard/75302.html.
ISP means an accredited identity service provider.
IXP means an accredited identity exchange provider.
linking credential means a document or other credential listed in Schedule 2.
Note: A linking credential demonstrates the continuity of the individual’s verified identity if that individual’s attributes have changed.
liveness detection means the measurement and analysis of biometric, biological and behavioural characteristics or involuntary or voluntary reactions of the live presentation of an individual, in order to determine if a biometric sample is being captured from a living individual who is physically present at the place and time when the biometric sample is captured.
local biometric binding means biometric binding conducted by and in the physical presence of an entity’s assessing officer.
manual face comparison means the process of using visual verification to compare the likeness of an individual to the individual’s claimed photo ID, conducted by, and in the physical presence of, an entity’s assessing officer.
material change, in relation to an entity, means any change that alone or cumulatively results in, or is reasonably likely to result in:
(a) a material or adverse impact on the entity’s DI data environment, proposed accredited services or accredited services; or
(b) an adverse impact on the entity’s ability to comply with the Act, these rules or the Accreditation Data Standards.
Note: The definition of ‘material change’ in these rules is different to the definition of the same expression in the Digital ID Rules.
non‑corporate Commonwealth entity has the same meaning as in the Public Governance, Performance and Accountability Act 2013.
online biometric binding means biometric binding conducted remotely via unsupervised data capture processes conducted across the internet.
penetration testing means testing conducted in accordance with Division 1 of Part 3.3 of Chapter 3.
personnel, of an entity, means:
(a) an employee of the entity; or
(b) an individual who, under a labour hire, consultancy or similar arrangement with the entity, performs work for the entity in relation to its proposed accredited services or accredited services.
photo ID means a document or other credential listed in Schedule 4.
physical authenticator: see rule 5.25.
presentation attack means the presentation of an artefact to a biometric data capture subsystem with the goal of interfering with the expected operation of the biometric capability.
presentation attack detection means automated discrimination between bona‑fide presentations and presentation attacks.
presentation attack instrument means an object or biometric characteristic that is used in a presentation attack.
Privacy Act means the Privacy Act 1988.
proposed accredited services, in relation to an applicant, means the services proposed to be provided by the entity in its application under section 14 of the Act for accreditation as an accredited entity.
protective security assessment means an assessment conducted in accordance with Division 1 of Part 3.2 of Chapter 3.
protective security capability: see Division 1 of Part 4.1 of Chapter 4.
protective security framework means:
(a) the PSPF; or
(b) ISO/IEC 27001; or
(c) an alternative framework (see rule 4.5).
protective security framework control means:
(a) a relevant PSPF control; or
(b) a control specified in ISO/IEC 27001; or
(c) a control specified in an alternative framework (see rule 4.5).
PSPF means the Protective Security Policy Framework published by the Australian Government.
Note 1: The PSPF could in 2025 be accessed at https://www.protectivesecurity.gov.au.
Note 2: At the time subrule 1.7(2) commenced, the current version of the PSPF was the PSPF published on 24 July 2025.
public‑facing proposed accredited services, in relation to an applicant, means the proposed accredited services or elements of the entity’s information technology system that an individual directly interacts with when using, or attempting to use, the entity’s proposed accredited services.
public‑facing accredited services, in relation to an accredited entity, means the accredited services or elements of the entity’s information technology system that an individual directly interacts with when using, or attempting to use, the entity’s accredited services.
Note: Example: An example of public‑facing accredited services is where an individual provides information to be verified via an ISP’s mobile app that the individual is required to download so as to access the entity’s accredited services.
public‑facing information related to proposed accredited services, in relation to an applicant, means information made available by the entity to individuals when interacting with the entity’s public‑facing proposed accredited services.
public‑facing information related to accredited services, in relation to an accredited entity, means information made available by the entity to individuals when interacting with the entity’s public‑facing accredited services.
Note: Example: Public‑facing information related to accredited services is the accredited entity’s privacy policy made available to individuals.
relevant PSPF control: see rule 4.3.
reporting period, for an accredited entity: see rule 6.1.
Note: Chapter 6 requires an accredited entity to conduct an annual review, and report on that review, in each 12‑month reporting period.
reusable digital ID means a digital ID verified for multiple uses by binding an authenticator to the digital ID.
risk assessment means the systematic, iterative and collaborative process of identification, analysis and evaluation of risk.
source biometric matching means the process of using source verification to verify that an acquired image biometrically matches the image on the document or other credential held by the authoritative source.
source verification means the process of verifying an attribute of an individual or a document or other credential in relation to the individual:
(a) with the authoritative source for that attribute or document or other credential; or
(b) through information provided by a service that confirms the veracity of the attribute or document or other credential with an authoritative source.
Note: A service that confirms the veracity of information includes a DVS or FVS (within the meaning of those terms in the Identity Verification Services Act 2023).
special attribute: see rule 5.32.
Note: An ASP is accredited to verify and manage a special attribute of an individual such as an authorisation for, or qualification of, an individual.
statement of scope and applicability means a statement that lists:
(a) for an applicant:
(i) each requirement in these rules and the Accreditation Data Standards with which the entity must comply in relation to its proposed accredited services if accredited; and
(ii) the evidence that demonstrates the entity will comply with those requirements if accredited; or
(b) for an accredited entity:
(i) each requirement in these rules and the Accreditation Data Standards with which the entity must comply in relation to its accredited services; and
(ii) the evidence that demonstrates the entity complies with those requirements.
system security plan: see rule 4.12.
systems testing means penetration testing, useability testing or WCAG testing.
taking reasonable steps: see rule 1.5.
technical biometric matching means the process of verifying that an acquired image biometrically matches the image of the individual on the document or credential, where the document or credential and the image have been verified using technical verification.
This is an opening excerpt, not the complete document.