The Digital Service Provider (DSP) Operational Security Framework (OSF) seeks to protect taxation, accounting, payroll, business registry and superannuation related data and the integrity of the Taxation, Business Registry and Superannuation systems that support the Australian community.
This is achieved by setting out a minimum level of security requirements a DSP needs to meet to access ATO digital services that perform a functional role in the supply chain.
The DSP OSF has been established to respond to business risks and security threats presented by the continual expansion and growth of digital services across the ecosystem and will continue to evolve to respond to new and emerging risks.
The DSP OSF is a response to known examples of:
- information misuse (including identity theft, personal gain, or commercial advantage)
- financial system misuse (including tax refund fraud)
- destructive cyber behaviour (including individual or system hacks).
If you want to use our API’s or digital services you will need to complete and submit a DSP OSF Security Questionnaire (DOCX, 768KB).
Should you need help completing the questionnaire, or if you have questions about the requirements, you can contact the Digital Partnership Office (DPO) via the DSP service desk in Online services for DSPsExternal link.
Find out more
- Scope of the DSP Operational Security Framework
- Meeting the requirements
- Maintaining compliance
- Data breaches
- Requirements for products and services
- Further guidance on requirements
See also
- Digital Service Provider Operational Security Framework Questionnaire (DOCX, 768KB)
- Australian Cyber Security CentreExternal link
- API risk ratings
- Australian Prudential Regulation AuthorityExternal link
- Essential 8External link
- Information Security ManualExternal link
- ISO standardsExternal link
- NISTExternal link
- OIAC Breach NotificationExternal link
- Online services for DSPs
- OWASPExternal link
- Security Standard for Add-on Marketplaces (SSAM)External link
- SOC2External link
- SSL LabsExternal link
- Using our services
- Acronyms