DSP is consuming medium and/or high risk APIs Self-assessment performed by a relevant internal All other DSP Commence representative in line with ISO / IEC 27001, ASVS3.0 products/services process by 01 3 or SOC2. February 2018. Encryption Implement encryption of data in transit for all All DSPs 01 February transmissions over public or shared network 2018 4 infrastructure using ASD approved cryptographic algorithms and protocols Implement full-disk, container, application or All DSPs that have 01 February database level encryption techniques using ASD control over a 2018 5 approved cryptographic algorithms and protocols. customer’s data at rest Implement payload encryption using Cryptographic DSPs that do not adopt TBD Message Syntax and an ASD approved Supply Chain Visibility 6 cryptographic algorithm requirements Supply Chain Visibility Implement supply chain visibility solution DSPs that do not adopt TBD payload encryption 7 Onshore/Offshore Data Hosting Consistent with guidelines for APRA-regulated All DSPs Immediate entities the ATO expects DSPs to apply a cautious and measured approach when considering 8 retaining data outside the jurisdiction it pertains to. By default, the ATO expects DSPs to store data onshore. Where there is a compelling reason for storing data All DSPs Immediate – outside of Australia a DSP must consult with the DSPs who don’t ATO prior to entering into any offshore data store data hosting arrangement so that the ATO may satisfy onshore itself that the impact has been adequately currently must addressed. As part of the consultation: commence 9 a. Digital Service Providers must consultation demonstrate that they have considered the with the ATO by jurisdictional of storing data in a 01 February foreign jurisdiction. 2018 b. The ATO can provide advice on jurisdictional constraints. Identity and Authentication
DSP is consuming medium and/or high risk APIs 3 Self-assessment performed by a relevant internal representative in line with ISO / IEC 27001, ASVS3.0 or SOC2. All other DSP products/services Commence process by 01 February 2018. Encryption 4 Implement encryption of data in transit for all transmissions over public or shared network infrastructure using ASD approved cryptographic algorithms and protocols All DSPs 01 February 2018 5 Implement full-disk, container, application or database level encryption techniques using ASD approved cryptographic algorithms and protocols. All DSPs that have control over a customer’s data at rest 01 February 2018 6 Implement payload encryption using Cryptographic Message Syntax and an ASD approved cryptographic algorithm DSPs that do not adopt Supply Chain Visibility requirements TBD Supply Chain Visibility 7 Implement supply chain visibility solution DSPs that do not adopt payload encryption TBD Onshore/Offshore Data Hosting 8 Consistent with guidelines for APRA-regulated entities the ATO expects DSPs to apply a cautious and measured approach when considering retaining data outside the jurisdiction it pertains to. By default, the ATO expects DSPs to store data onshore. All DSPs Immediate 9 Where there is a compelling reason for storing data outside of Australia a DSP must consult with the ATO prior to entering into any offshore data hosting arrangement so that the ATO may satisfy itself that the impact has been adequately addressed. As part of the consultation: a. Digital Service Providers must demonstrate that they have considered the jurisdictional of storing data in a foreign jurisdiction. b. The ATO can provide advice on jurisdictional constraints. All DSPs Immediate – DSPs who don’t store data onshore currently must commence consultation with the ATO by 01 February 2018 Identity and Authentication