5.1General requirements

5.1 General requirements

(1) When generating a digital ID, an ISP must: (a) unless the ISP is generating a digital ID in accordance with an alternative proofing process: (i) comply with the requirements in this Part applicable to the accredited service being provided and the manner of providing that service; (ii) comply with the Accreditation Data Standards applicable to the accredited service being provided and the manner of providing that service; and (iii) verify the identity of the individual using only documents or other credentials of a kind listed in Schedules 1 to 4 which are verified in accordance with the requirement in column 2 of the relevant schedule; and (b) at the time of generating the digital ID: (i) bind an identity proofing level to the digital ID by complying with each requirement specified as ‘must’ or ‘yes’ in the column of the IP Levels Table for the relevant identity proofing level to be bound to the digital ID; (ii) for a reuseable digital ID—bind one or more authenticators to the digital ID; and (c) must not assert an identity proofing level or authentication level for a digital ID unless: (i) other than if the ISP is generating a digital ID in accordance with an alternative proofing process—each of the requirements in the IP Levels Table for that identity proofing level has been met; and (ii) each of the requirements in the AL Table for that authentication level has been met. (2) An ISP must not assert that its processes for a particular identity proofing level creates assurance for that level that is similar or equivalent to a higher identity proofing level.