The Digital ID obligations register
Eighty obligations under Australia's Digital ID regime, cited provision by provision, mapped to the six control frameworks you already hold — and marked with the evidence an assessor will actually ask for.
Free. Version 1.0, October 2026.
Ten of the eighty are fully answered by ISO 27001, SOC 2, the APPs and ISO 27701 combined. Thirty-seven have no equivalent in any of them. That gap is the reason this exists.
What you get
Artefact A — Combined
All 80 obligations in one filterable register, with an "Applies to" column carrying the entity role. The whole-of-scheme view.
Artefact B — By role
The same 80 obligations split across four tabs — Identity Service Provider, Attribute Service Provider, Identity Exchange Provider, Relying Party. Obligation IDs match across both files, so DID-034 is the same obligation wherever you see it.
Both carry: a coverage summary that recalculates as you fill it in, a gap view that builds itself from your status column, framework crosswalks so you can enter from the ISO or SOC 2 side, and a read me that tells you what it does not cover.
Sourced from
Digital ID Act 2024 (Cth)
Digital ID (Accreditation) Rules 2024
Digital ID Rules 2024
Digital ID (Accreditation) Data Standards 2024
Mapped against
ISO/IEC 27001:2022 · ACSC Essential Eight · SOC 2 Trust Services Criteria · Australian Privacy Principles · ISO/IEC 27701:2019 · fraud management control domains
