# Guidance > Australian regulator guidance that Comms.ID tracks, as Markdown, with its source and freshness. Copies of public regulator guidance, kept by Comms.ID to cite in its controls. The publisher owns each text and its licence; every document names its source URL. Not legal advice, and not an official copy. Snapshot: comms-id/guidance commit db3111cd9d11643ac08b34b4d75b0d0d983ca388. A weekly Cloudflare Workflow checks every source for changes; see /freshness.json. ## Agent resources - [index.json](https://guidance.comms.id/index.json): every collection and document: title, summary, status, source URL, source page, pinned SHA-256, Markdown path. - [MCP](https://guidance.comms.id/mcp): read-only MCP server (Streamable HTTP, POST JSON-RPC): list_collections, search_guidance (metadata or fulltext), get_document, read_guidance. - [freshness.json](https://guidance.comms.id/freshness.json): the latest freshness check: content hash per source, the day each hash was first seen, and open findings. ## asd-ism - [Using the cyber security framework](https://guidance.comms.id/asd-ism/using-the-cyber-security-framework.md): ISM Using the cyber security framework controls and guidance for ASD-approved accreditation posture. - [Cyber security principles](https://guidance.comms.id/asd-ism/cyber-security-principles.md): ISM Cyber security principles controls and guidance for ASD-approved accreditation posture. - [Guidelines for cyber security roles](https://guidance.comms.id/asd-ism/guidelines-for-cyber-security-roles.md): ISM Guidelines for cyber security roles controls and guidance for ASD-approved accreditation posture. - [Guidelines for cyber security incidents](https://guidance.comms.id/asd-ism/guidelines-for-cyber-security-incidents.md): ISM Guidelines for cyber security incidents controls and guidance for ASD-approved accreditation posture. - [Guidelines for procurement and outsourcing](https://guidance.comms.id/asd-ism/guidelines-for-procurement-and-outsourcing.md): ISM Guidelines for procurement and outsourcing controls and guidance for ASD-approved accreditation posture. - [Guidelines for cyber security documentation](https://guidance.comms.id/asd-ism/guidelines-for-cyber-security-documentation.md): ISM Guidelines for cyber security documentation controls and guidance for ASD-approved accreditation posture. - [Guidelines for physical security](https://guidance.comms.id/asd-ism/guidelines-for-physical-security.md): ISM Guidelines for physical security controls and guidance for ASD-approved accreditation posture. - [Guidelines for personnel security](https://guidance.comms.id/asd-ism/guidelines-for-personnel-security.md): ISM Guidelines for personnel security controls and guidance for ASD-approved accreditation posture. - [Guidelines for communications infrastructure](https://guidance.comms.id/asd-ism/guidelines-for-communications-infrastructure.md): ISM Guidelines for communications infrastructure controls and guidance for ASD-approved accreditation posture. - [Guidelines for communications systems](https://guidance.comms.id/asd-ism/guidelines-for-communications-systems.md): ISM Guidelines for communications systems controls and guidance for ASD-approved accreditation posture. - [Guidelines for enterprise mobility](https://guidance.comms.id/asd-ism/guidelines-for-enterprise-mobility.md): ISM Guidelines for enterprise mobility controls and guidance for ASD-approved accreditation posture. - [Guidelines for evaluated products](https://guidance.comms.id/asd-ism/guidelines-for-evaluated-products.md): ISM Guidelines for evaluated products controls and guidance for ASD-approved accreditation posture. - [Guidelines for information technology equipment](https://guidance.comms.id/asd-ism/guidelines-for-information-technology-equipment.md): ISM Guidelines for information technology equipment controls and guidance for ASD-approved accreditation posture. - [Guidelines for media](https://guidance.comms.id/asd-ism/guidelines-for-media.md): ISM Guidelines for media controls and guidance for ASD-approved accreditation posture. - [Guidelines for system hardening](https://guidance.comms.id/asd-ism/guidelines-for-system-hardening.md): ISM Guidelines for system hardening controls and guidance for ASD-approved accreditation posture. - [Guidelines for system access](https://guidance.comms.id/asd-ism/guidelines-for-system-access.md): ISM Guidelines for system access controls and guidance for ASD-approved accreditation posture. - [Guidelines for system management](https://guidance.comms.id/asd-ism/guidelines-for-system-management.md): ISM Guidelines for system management controls and guidance for ASD-approved accreditation posture. - [Guidelines for security assurance](https://guidance.comms.id/asd-ism/guidelines-for-security-assurance.md): ISM Guidelines for security assurance controls and guidance for ASD-approved accreditation posture. - [Guidelines for software development](https://guidance.comms.id/asd-ism/guidelines-for-software-development.md): ISM Guidelines for software development controls and guidance for ASD-approved accreditation posture. - [Guidelines for database systems](https://guidance.comms.id/asd-ism/guidelines-for-database-systems.md): ISM Guidelines for database systems controls and guidance for ASD-approved accreditation posture. - [Guidelines for email](https://guidance.comms.id/asd-ism/guidelines-for-email.md): ISM Guidelines for email controls and guidance for ASD-approved accreditation posture. - [Guidelines for networking](https://guidance.comms.id/asd-ism/guidelines-for-networking.md): ISM Guidelines for networking controls and guidance for ASD-approved accreditation posture. - [Guidelines for cryptography](https://guidance.comms.id/asd-ism/guidelines-for-cryptography.md): ISM Guidelines for cryptography controls and guidance for ASD-approved accreditation posture. - [Guidelines for gateways](https://guidance.comms.id/asd-ism/guidelines-for-gateways.md): ISM Guidelines for gateways controls and guidance for ASD-approved accreditation posture. - [Guidelines for data transfers](https://guidance.comms.id/asd-ism/guidelines-for-data-transfers.md): ISM Guidelines for data transfers controls and guidance for ASD-approved accreditation posture. - [Cyber security terminology](https://guidance.comms.id/asd-ism/cyber-security-terminology.md): ISM Cyber security terminology controls and guidance for ASD-approved accreditation posture. ## asd-pqc - [Post-quantum questions to ask your vendors](https://guidance.comms.id/asd-pqc/post-quantum-questions-to-ask-your-vendors.md): ASD vendor-neutral questions for assessing PQC readiness across cryptographic inventory, risk, transition priorities, implementation and stakeholder communication. ## ASIC IDR Data Reporting - [IDR data reporting handbook](https://guidance.comms.id/asic-regulatory-guides/idr-data-reporting/idr-data-reporting-handbook-and-dictionary.md): ASIC's current IDR reporting handbook, including the data dictionary, data glossary, report-file schema, validation rules, submission process and checklist. ## ASIC Regulatory Guide 267 - [RG 267 Oversight of the Australian Financial Complaints Authority](https://guidance.comms.id/asic-regulatory-guides/rg-267/rg-267-afca-oversight.md): ASIC guidance on AFCA membership, external dispute-resolution obligations, ASIC oversight, AFCA compliance requirements and the EDR benchmarks. ## ASIC Regulatory Guide 271 - [RG 271 Internal dispute resolution](https://guidance.comms.id/asic-regulatory-guides/rg-271/rg-271-internal-dispute-resolution.md): ASIC's enforceable IDR standards and requirements covering complaints, accessibility, acknowledgement, response contents and timeframes, systemic issues, governance, records and improvement. ## AUSTRAC customer due diligence - [Overview of initial customer due diligence](https://guidance.comms.id/austrac-cdd/initial-cdd-overview.md): Establish the initial CDD matters and timing before service. - [Initial CDD for bodies corporate](https://guidance.comms.id/austrac-cdd/body-corporate.md): Identify the IC and distinguish governance information from individual verification. - [Initial CDD for individuals](https://guidance.comms.id/austrac-cdd/individuals.md): Verify relevant people with risk-appropriate independent evidence. - [Initial CDD for trusts](https://guidance.comms.id/austrac-cdd/trusts.md): Apply the separate trust route when an IC acts as trustee. - [Identifying individuals without standard ID](https://guidance.comms.id/austrac-cdd/alternative-id.md): Provide an evidence-based alternative when standard documents cannot be obtained. - [Alternative ID for First Nations peoples](https://guidance.comms.id/austrac-cdd/first-nations-id.md): Address culturally specific naming and document-access barriers. - [Enhanced customer due diligence](https://guidance.comms.id/austrac-cdd/enhanced-cdd.md): Apply mandatory escalation and proportionate enhanced checks. - [Politically exposed persons](https://guidance.comms.id/austrac-cdd/pep.md): Screen relevant people and apply the correct PEP controls. - [Overview of ongoing customer due diligence](https://guidance.comms.id/austrac-cdd/ongoing-cdd.md): Detect changes to control, authority, identity and transaction risk. - [Suspicious matter reports](https://guidance.comms.id/austrac-cdd/suspicious-matters.md): Handle reportable suspicion and the correct reporting clock. - [Record keeping overview](https://guidance.comms.id/austrac-cdd/record-keeping.md): Retain evidence and decision records under the right retention clock. - [AML/CTF Transitional Rules 2026](https://guidance.comms.id/austrac-cdd/transition.md): Distinguish eligible legacy ACIP classes from current initial CDD. - [Professional designated services](https://guidance.comms.id/austrac-cdd/professional-services.md): Check service-specific CATSI exclusions before imposing AML obligations. ## digital-id-accreditation - [Applying for accreditation](https://guidance.comms.id/digital-id-accreditation/applying-for-accreditation.md): ACCC guidance on the Digital ID accreditation framework, application evidence, assessment, conditions, changes and compliance obligations. - [Guidance for accredited entities in Australia's Digital ID System](https://guidance.comms.id/digital-id-accreditation/accredited-entity-obligations.md): ACCC guidance on maintaining accreditation, annual reviews, changes, notification duties, compliance and enforcement. - [Internal review of Digital ID Regulator decisions](https://guidance.comms.id/digital-id-accreditation/internal-review-regulator-decisions.md): ACCC factsheet on internally reviewable Digital ID decisions, application timing, standing, process and outcomes. - [Organisation and Authorised Officer form](https://guidance.comms.id/digital-id-accreditation/organisation-authorised-officer-form.md): Regulator form for registering an organisation and its accountable Authorised Officer. - [Service and Contact Person form](https://guidance.comms.id/digital-id-accreditation/service-contact-person-form.md): Regulator form for registering a service and its operational contact people. - [Accreditation application form](https://guidance.comms.id/digital-id-accreditation/accreditation-application-form.md): Digital ID accreditation application questions, document uploads, testing evidence and organisational assurances. - [Declaration for entities seeking accreditation](https://guidance.comms.id/digital-id-accreditation/accreditation-declaration.md): Authorised Officer declarations that an accreditation application is complete, correct and compliant. - [Declaration technical testing attestation statement for entities seeking accreditation](https://guidance.comms.id/digital-id-accreditation/technical-testing-attestation.md): Regulator attestation that applicable Digital ID technical testing requirements have been met. - [Approval to participate in the AGDIS form](https://guidance.comms.id/digital-id-accreditation/agdis-approval-application.md): Application form for approval to participate in the Australian Government Digital ID System. - [Plans and procedure declarations for relying parties applying to participate in the AGDIS](https://guidance.comms.id/digital-id-accreditation/relying-party-plans-declaration.md): Relying-party declaration covering notification procedures, cyber security, fraud, disaster recovery and business continuity plans. - [Plans and procedures declaration for accredited entities seeking approval to participate in the AGDIS](https://guidance.comms.id/digital-id-accreditation/accredited-entity-agdis-procedures-declaration.md): Declaration that an accredited entity has required System Administrator notification procedures. - [Declaration for compliance for all entities applying to participate in the AGDIS](https://guidance.comms.id/digital-id-accreditation/agdis-compliance-declaration.md): Declaration that an AGDIS applicant will comply with applicable Digital ID legislation. - [Final Declaration for all entities seeking approval to participate in the AGDIS](https://guidance.comms.id/digital-id-accreditation/agdis-final-declaration.md): Final Authorised Officer declaration that AGDIS application information is true and complete. - [AGDIS exemptions for participating relying parties form](https://guidance.comms.id/digital-id-accreditation/relying-party-voluntariness-exemption.md): Application form for a participating relying party seeking exemption from the voluntariness requirement. - [Application to vary participation start date for AGDIS approval](https://guidance.comms.id/digital-id-accreditation/vary-agdis-participation-start-date.md): Application form to vary the start date for an entity's AGDIS participation. - [Evidence it is appropriate to accredit or approve the organisation](https://guidance.comms.id/digital-id-accreditation/appropriate-to-accredit-or-approve.md): Regulator form for organisational evidence supporting the appropriateness assessment. - [Fit and proper person declaration for associated persons](https://guidance.comms.id/digital-id-accreditation/fit-and-proper-person-declaration.md): Personal declaration supporting the Regulator's fit-and-proper assessment of associated persons. - [Conditions on accreditation or AGDIS approval form](https://guidance.comms.id/digital-id-accreditation/conditions-on-accreditation-or-approval.md): Application form to impose, vary or revoke a condition on accreditation or AGDIS approval. - [Revocation of Accreditation or AGDIS approval form](https://guidance.comms.id/digital-id-accreditation/revoke-accreditation-or-approval.md): Application form for voluntary revocation of accreditation or AGDIS approval. - [Suspension of accreditation or AGDIS approval form](https://guidance.comms.id/digital-id-accreditation/suspend-accreditation-or-approval.md): Application form for suspension of accreditation or AGDIS approval. - [Application to vary accreditation or AGDIS approval form](https://guidance.comms.id/digital-id-accreditation/vary-accreditation-or-approval.md): Application form to vary organisation or service names on accreditation or AGDIS approval. - [Handling personal information when providing accredited Digital ID services](https://guidance.comms.id/digital-id-accreditation/handling-personal-information.md): OAIC guidance on Digital ID-specific collection, use, disclosure, retention, destruction and prohibited handling of personal information. - [Handling biometric information when providing accredited Digital ID services](https://guidance.comms.id/digital-id-accreditation/biometric-information.md): OAIC guidance on permitted and prohibited biometric handling, express consent, matching and destruction deadlines. - [Law enforcement access to Digital ID information](https://guidance.comms.id/digital-id-accreditation/law-enforcement-access.md): OAIC guidance on permitted law-enforcement access, warrants, consent and prohibited enforcement purposes. - [Express consent in Australia's Digital ID System](https://guidance.comms.id/digital-id-accreditation/express-consent.md): OAIC guidance on the meaning, elements, timing, withdrawal and evidencing of express consent under the Digital ID Act. - [Interaction between the Digital ID Act and the Privacy Act](https://guidance.comms.id/digital-id-accreditation/digital-id-and-privacy-acts.md): OAIC guidance on how Digital ID privacy safeguards interact with the Privacy Act and comparable state or territory laws. - [Relying parties privacy obligations when handling personal information](https://guidance.comms.id/digital-id-accreditation/relying-party-privacy-obligations.md): OAIC guidance on privacy obligations for participating and non-participating relying parties handling Digital ID information. - [Applicable notifiable data breach and privacy obligations for accredited entities](https://guidance.comms.id/digital-id-accreditation/notifiable-data-breach-obligations.md): OAIC guidance on NDB coverage, response plans and additional Digital ID Regulator notification duties for accredited entities. ## oaic-privacy - [Preface](https://guidance.comms.id/oaic-privacy/preface.md): OAIC context for the status, purpose and use of the Australian Privacy Principles Guidelines. - [Summary of version changes to APP Guidelines](https://guidance.comms.id/oaic-privacy/summary-of-version-changes-to-app-guidelines.md): OAIC change history for the Australian Privacy Principles Guidelines. - [Chapter A: Introductory matters](https://guidance.comms.id/oaic-privacy/chapter-a-introductory-matters.md): OAIC guidance on APP scope, structure, accountability and interpretation. - [Chapter B: Key concepts](https://guidance.comms.id/oaic-privacy/chapter-b-key-concepts.md): OAIC interpretation of consent, APP-entity coverage, reasonable necessity, reasonable steps and other Privacy Act concepts. - [Chapter C: Permitted general situations](https://guidance.comms.id/oaic-privacy/chapter-c-permitted-general-situations.md): OAIC guidance on the Privacy Act's permitted general situations, including suspected unlawful activity and serious threats. - [Chapter D: Permitted health situations](https://guidance.comms.id/oaic-privacy/chapter-d-permitted-health-situations.md): OAIC guidance on permitted health situations for collection, use and disclosure. - [Chapter 1: APP 1 Open and transparent management of personal information](https://guidance.comms.id/oaic-privacy/chapter-1-app-1-open-transparent-management.md): OAIC guidance on privacy governance, practices and APP privacy-policy contents. - [Chapter 2: APP 2 Anonymity and pseudonymity](https://guidance.comms.id/oaic-privacy/chapter-2-app-2-anonymity-pseudonymity.md): OAIC guidance on offering anonymous or pseudonymous dealings and the available exceptions. - [Chapter 3: APP 3 Collection of solicited personal information](https://guidance.comms.id/oaic-privacy/chapter-3-app-3-solicited-collection.md): Current OAIC guidance on solicited collection, sensitive information, consent, proportionality, data minimisation, AI and facial recognition. - [Chapter 4: APP 4 Dealing with unsolicited personal information](https://guidance.comms.id/oaic-privacy/chapter-4-app-4-unsolicited-information.md): OAIC guidance on assessing, retaining, destroying or de-identifying unsolicited personal information. - [Chapter 5: APP 5 Notification of the collection of personal information](https://guidance.comms.id/oaic-privacy/chapter-5-app-5-collection-notification.md): OAIC guidance on collection notices, timing and required notification matters. - [Chapter 6: APP 6 Use or disclosure of personal information](https://guidance.comms.id/oaic-privacy/chapter-6-app-6-use-disclosure.md): OAIC interpretation of primary purposes, secondary uses and disclosures, consent, reasonable expectations and statutory exceptions. - [Chapter 7: APP 7 Direct marketing](https://guidance.comms.id/oaic-privacy/chapter-7-app-7-direct-marketing.md): OAIC guidance on direct-marketing restrictions, consent and opt-out requirements. - [Chapter 8: APP 8 Cross-border disclosure of personal information](https://guidance.comms.id/oaic-privacy/chapter-8-app-8-cross-border-disclosure.md): OAIC guidance on overseas recipients, contractor access, effective control, reasonable steps, accountability and exceptions. - [Chapter 9: APP 9 Adoption, use or disclosure of government related identifiers](https://guidance.comms.id/oaic-privacy/chapter-9-app-9-government-identifiers.md): OAIC guidance on adopting, using and disclosing government-related identifiers. - [Chapter 10: APP 10 Quality of personal information](https://guidance.comms.id/oaic-privacy/chapter-10-app-10-information-quality.md): OAIC guidance on reasonable steps to ensure personal information quality for its intended handling. - [Chapter 11: APP 11 Security of personal information](https://guidance.comms.id/oaic-privacy/chapter-11-app-11-security-retention.md): OAIC guidance on protecting held personal information and destroying or de-identifying it when no permitted purpose or retention law remains. - [Chapter 12: APP 12 Access to personal information](https://guidance.comms.id/oaic-privacy/chapter-12-app-12-access.md): OAIC guidance on individual access requests, response handling, refusal grounds and notices. - [Chapter 13: APP 13 Correction of personal information](https://guidance.comms.id/oaic-privacy/chapter-13-app-13-correction.md): OAIC guidance on correction duties, third-party notification, refusal notices and associated statements. - [Guidance on privacy and developing and training generative AI models](https://guidance.comms.id/oaic-privacy/developing-training-ai-models.md): OAIC guidance on privacy by design, collection, transparency, consent and secondary use when personal information trains AI models. - [Privacy guidance for reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act](https://guidance.comms.id/oaic-privacy/aml-ctf-reporting-entities.md): OAIC guidance on Privacy Act scope, collection, notices, use, overseas disclosure, security, retention and deletion for AML/CTF reporting entities and authorised agents. - [Tips for good privacy practice](https://guidance.comms.id/oaic-privacy/tips-for-good-privacy-practice.md): OAIC operational checklist spanning privacy by design, policies, minimisation, consent, third parties, security, breach readiness and governance. - [Privacy by design](https://guidance.comms.id/oaic-privacy/privacy-by-design.md): OAIC guidance on embedding privacy controls throughout product and service design. - [Guide to developing an APP privacy policy](https://guidance.comms.id/oaic-privacy/developing-app-privacy-policy.md): OAIC guidance on the required content, structure, accessibility and maintenance of an APP privacy policy. - [De-identification and the Privacy Act](https://guidance.comms.id/oaic-privacy/de-identification-and-privacy-act.md): OAIC guidance on when information is de-identified, re-identification risk and governance of de-identification decisions. - [Sending personal information overseas](https://guidance.comms.id/oaic-privacy/sending-personal-information-overseas.md): OAIC guidance on overseas disclosures, cloud and contractor arrangements, accountability and APP 8 exceptions. - [Guide to securing personal information](https://guidance.comms.id/oaic-privacy/securing-personal-information.md): OAIC guidance on the reasonable steps, governance, ICT, access, lifecycle and destruction controls expected under APP 11. - [Privacy management framework: enabling compliance and encouraging good practice](https://guidance.comms.id/oaic-privacy/privacy-management-framework.md): OAIC governance framework covering leadership, privacy capability, risk controls, assurance and continuous improvement. - [Handling privacy complaints](https://guidance.comms.id/oaic-privacy/handling-privacy-complaints.md): OAIC guidance and checklist for receiving, investigating, responding to, recording and learning from privacy complaints. - [Notifiable data breaches](https://guidance.comms.id/oaic-privacy/notifiable-data-breaches.md): OAIC NDB hub covering prevention, preparation, response, reporting and current operational guidance. - [About the Notifiable Data Breaches scheme](https://guidance.comms.id/oaic-privacy/about-notifiable-data-breaches.md): OAIC overview of NDB scheme coverage and the duty to notify eligible data breaches. - [When to report a data breach](https://guidance.comms.id/oaic-privacy/when-to-report-data-breach.md): OAIC guidance on the eligible-data-breach test, likely serious harm, remedial action and assessment. - [Report a data breach](https://guidance.comms.id/oaic-privacy/report-a-data-breach.md): OAIC instructions for preparing and submitting an eligible data-breach statement and notifying individuals. - [Quick reference guide for responding to data breaches](https://guidance.comms.id/oaic-privacy/data-breach-quick-reference.md): OAIC quick-reference sequence for containing, assessing, notifying and reviewing a data breach. - [Data breach preparation and response](https://guidance.comms.id/oaic-privacy/data-breach-preparation-response.md): OAIC guide landing page, revision context and routes for preparing for and responding to breaches under the Privacy Act. - [Preventing data breaches: advice from the Australian Cyber Security Centre](https://guidance.comms.id/oaic-privacy/preventing-data-breaches-acsc-advice.md): OAIC-hosted ACSC advice on staff awareness, credentials, authentication, patching and other controls that reduce data-spill and breach risk. - [Guidance for entities in preparing for and responding to cyber incidents](https://guidance.comms.id/oaic-privacy/cyber-incident-preparation-response.md): OAIC guidance on breach plans, information inventories, providers, access and audit controls, harm minimisation and cyber-incident prevention. - [Purpose and structure of the data breach preparation and response guide](https://guidance.comms.id/oaic-privacy/data-breach-guide-purpose-structure.md): OAIC explanation of the guide's objectives, preparation and response lifecycle, and relationship to NDB obligations. - [Part 1: Data breaches and the Australian Privacy Act](https://guidance.comms.id/oaic-privacy/data-breach-guide-part-1.md): OAIC guidance on breach types, causes, harms and Privacy Act security obligations. - [Part 2: Preparing a data breach response plan](https://guidance.comms.id/oaic-privacy/data-breach-guide-part-2.md): OAIC guidance on response-plan contents, escalation, team membership, authority, testing and review. - [Part 3: Responding to data breaches – four key steps](https://guidance.comms.id/oaic-privacy/data-breach-guide-part-3.md): OAIC four-step response process covering containment, assessment, notification and review. - [Part 4: Notifiable Data Breach (NDB) Scheme](https://guidance.comms.id/oaic-privacy/data-breach-guide-part-4.md): Detailed OAIC guidance on eligible breaches, serious harm, assessments, remedial action, notification and exceptions. - [Part 5: Other sources of information](https://guidance.comms.id/oaic-privacy/data-breach-guide-part-5.md): OAIC routes to complementary cyber-security, identity, financial, health and government breach resources. - [Appendix A: Key terms](https://guidance.comms.id/oaic-privacy/data-breach-guide-appendix-key-terms.md): Definitions used throughout the OAIC data-breach preparation and response guide. ## ORIC governance and authority - [Guide to using corporation information](https://guidance.comms.id/oric-governance/register-evidence.md): Understand ORIC extracts, rule books and regulatory notices as identity evidence. - [Delegating board powers](https://guidance.comms.id/oric-governance/delegation.md): Establish the scope and validity of a representative delegation. - [Contact person and secretary](https://guidance.comms.id/oric-governance/contact-secretary.md): Separate contact duties from general authority to bind an IC. - [Special administrations](https://guidance.comms.id/oric-governance/special-administration.md): Detect changes to offices and powers when an administrator takes control. - [Native title and RNTBCs](https://guidance.comms.id/oric-governance/native-title.md): Distinguish an RNTBC corporate, trustee and agent capacity. - [Decision-making in RNTBCs](https://guidance.comms.id/oric-governance/native-title-decisions.md): Check native-title consultation and consent alongside board authority.