ATO Digital Service Provider (DSP) Operational Security Framework PROC.ANNUAL: Annual assurance review

DSPs provide annual assurance that their products and services remain compliant with the OSF controls and requirements, responding to the annual review ticket raised in the DSP service desk; the review checks the currency of the self-assessment (current for two years from ATO approval) or independent certification (current to the certificate's expiry). The ATO also conducts ad hoc reviews.

Other controls in Registration, maintaining compliance and data breach reporting – ATO Digital Service Provider (DSP) Operational Security Framework

PROC.BREACH Report data breaches to the ATO within one business day
PROC.CHANGE Notify the DPO of significant changes to the business or product
PROC.HOSTED Isolate hosted client instances and limit DSP access to support with consent
PROC.PRODUCTID Keep ATO product IDs confidential and use them only as intended
PROC.REGISTER Register, complete the OSF questionnaire and evidence every control
PROC.SSP Describe the sending service provider model and value chain
PROC.TRUE Give the ATO true and correct information and keep details current

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All ATO Digital Service Provider (DSP) Operational Security Framework controls