2.1DI data environment

2.1 DI data environment

For the purposes of paragraph 15(4)(d) of the Act, the Digital ID Regulator must not accredit an applicant unless the Regulator is satisfied that the applicant: (a) has correctly identified, defined and documented the boundaries of its DI data environment, including: (i) the people, processes, technology and infrastructure that will manage, secure, store or otherwise interact with the information generated, collected, used, held or disclosed for the purpose of providing its accredited services, if the applicant is accredited; and (ii) the infrastructure owned by, and management provided by, any contractor engaged, or proposed to be engaged, by the applicant to provide a proposed accredited service, or part of a proposed accredited service, if the applicant is accredited; (b) has limited the boundaries of its DI data environment to the extent practicable, including by: (i) segregating the environment from other systems; (ii) minimising the number of people who interact with the information referred to in paragraph (a); (iii) limiting the number of systems hosting, processing or accessing the information referred to in paragraph (a); and (iv) minimising the use of contracted service providers interacting with the information referred to in paragraph (a).