NIST HANDBOOK 150-25 

2009 Edition 

National 

Voluntary

Laboratory 

Accreditation 

Program 

BIOMETRICS

TESTING

Brad Moore and Michaela Iorga 

National Voluntary Laboratory Accreditation Program 

Standards Services Division 

Technology Services 

July 2009 

U.S. Department of Commerce 

Gary Locke, Secretary 

National Institute of Standards and Technology 

Patrick D. Gallagher, Deputy Director 
Errata Sheet 

NIST Handbook 150-25, Biometrics Testing (July 2009) 

September 14, 2009 

This errata sheet lists errors and corrections noted in NIST Handbook 150-25, Biometrics Testing (July 2009). The li

of the noted error and summarizes the correction. 

Page Section Delete Replace

42 A.2.3.7 A.2.3.7.1 National standards 

— Guidance Package: Biometrics for Airport Access 

Control, 30 September 2005, Transportation Security Administration, http://www.tsa.gov/assets/pdf/biometrics_guidance.pdf 

— INCIT Project 1602-5: Information Technology - 

Biometric Performance Testing and Reporting - Part 5: Framework for Testing and Evaluation of Biometric Systems for Access Control, June 2008, under development 

A.2.3.7.2 International standards — 1.37.19795.5: Information Technology – Biometric 

Performance Testing and Reporting – Part 5: Performance of Biometric Access Control Systems, under development 

— Guidance Package: Biometrics 

Control, 30 September 2005, TAdministration, http://www.tsa.gov/assets/pdf/

Errata Sheet – NIST Handbook 150-25 (July 2009 edition) – 2009-09-14 
Errata Sheet – NIST Handbook 150-25 (July 2009 edition) – 2009-09-14 

Page Section Delete Replace

42 A.2.3.8 A.2.3.8 Additional references for Technology Testing 

(30/TT) - general A.2.3.8.1 National standards — ANSI INCITS 409.2-2005: Information Technology - 

Biometric Performance Testing and Reporting – Part 2: Technology Testing and Reporting, 

http://webstore.ansi.org 

A.2.3.8.2 International standards — ISO/IEC Project 19795-1:2006: Information 

Technology - Biometric Performance Testing and Reporting – Part 1: Principles and Framework, http://www.iso.org 

— ISO/IEC 19795-2:2007: Information Technology - 

Biometric Performance Testing and Reporting – Part 2: Testing Methodologies for Technology and Scenario Evaluation, particularly clause 6, http://www.iso.org 

A.2.3.8 Additional references Performance Testing (30/GPT) A.2.3.8.1 National standards — INCIT Project 1602-5: Informa

Biometric Performance Testin5: Framework for Testing and Systems for Access Control, Apdevelopment 

A.2.3.8.2 International standar— 1.37.19795.5: Information Tec

Performance Testing and RepoScheme for Access Control Scedevelopment 
NVLAP AND THE NVLAP LOGO 

The term NVLAP and the NVLAP logo are registered 

marks of the Federal Government, which retains 

exclusive rights to control the use thereof. Permission 

to use the term and symbol (NVLAP logo with 

approved caption) is granted to NVLAP-accredited 

laboratories for the limited purpose of announcing 

their accredited status, and for use on reports that 

describe only testing and calibration within the scope 

of accreditation. NVLAP reserves the right to control 

the quality of the use of the NVLAP term, logo, and 

symbol.
Contents 

Acknowledgments.........................................................................................................................................v

Foreword......................................................................................................................................................vi

Introduction.................................................................................................................................................vii

1 General information ...............................................................................................................................1

1.1 Scope ...........................................................................................................................................1

1.2 Organization of handbook ...........................................................................................................1

1.3 Program description.....................................................................................................................1

1.4 References ...................................................................................................................................2

1.5 Terms and definitions ..................................................................................................................3

1.6 Program documentation...............................................................................................................6

2 LAP establishment, development and implementation ..........................................................................8

2.1 Bases for establishment ...............................................................................................................8

2.2 Development of technical requirements ......................................................................................8

2.3 Announcing the establishment of a LAP.....................................................................................8

2.4 Adding to or modifying a LAP....................................................................................................8

2.5 Termination of a LAP..................................................................................................................8

3 Accreditation Process .............................................................................................................................8

3.1 Application for initial accreditation.............................................................................................8

3.2 Activities prior to initial on-site assessment..............................................................................10

3.3 On-site assessments ...................................................................................................................10

3.4 Proficiency Testing....................................................................................................................13

3.5 Accreditation decision ...............................................................................................................14

3.6 Granting accreditation ...............................................................................................................15

3.7 Renewal of accreditation ...........................................................................................................15

3.8 Monitoring visits .......................................................................................................................15

3.9 Changes to scope of accreditation .............................................................................................15

3.10 Suspension of accreditation.......................................................................................................15

3.11 Denial and revocation of accreditation......................................................................................16

3.12 Voluntary termination of accreditation......................................................................................16

3.13 Appeals......................................................................................................................................16

3.14 Conflict of interest.....................................................................................................................16

4 Management requirements for accreditation ........................................................................................16

4.1 Organization ..............................................................................................................................16

4.2 Management system ..................................................................................................................17

4.3 Document control ......................................................................................................................17

4.4 Review of requests, tenders and contracts.................................................................................18

4.5 Subcontracting of tests and calibrations ....................................................................................19

4.6 Purchasing services and supplies...............................................................................................19

4.7 Service to the customer..............................................................................................................19

4.8 Complaints.................................................................................................................................19

4.9 Control of nonconforming testing and/or calibration work.......................................................19

NIST Handbook 150-25:2009 iii 
4.10 Improvement..............................................................................................................................19

4.11 Corrective action .......................................................................................................................19

4.12 Preventive action .......................................................................................................................19

4.13 Control of records......................................................................................................................20

4.14 Internal audits ............................................................................................................................21

4.15 Management reviews.................................................................................................................21

5 Technical requirements for accreditation .............................................................................................22

5.1 General ......................................................................................................................................22

5.2 Personnel ...................................................................................................................................22

5.3 Accommodation and environmental conditions ........................................................................24

5.4 Test and calibration methods and method validation ................................................................25

5.5 Equipment..................................................................................................................................25

5.6 Measurement traceability ..........................................................................................................26

5.7 Sampling....................................................................................................................................27

5.8 Handling of test and calibration items.......................................................................................27

5.9 Assuring the quality of test and calibration results....................................................................27

5.10 Reporting the results..................................................................................................................28

6 Additional requirements .......................................................................................................................29

Annex A......................................................................................................................................................30

A.1 Additional general information .................................................................................................30

A.2 Scopes of accreditation, test methods, additional references, terms and conditions .................31

A.3 Additional accreditation process requirements..........................................................................43

A.4 Additional management requirements for accreditation............................................................46

A.5 Additional technical requirements for accreditation..................................................................46

Annex B ......................................................................................................................................................51

iv NIST Handbook 150-25:2009 
Acknowledgments 

The authors would like to thank the persons who reviewed and contributed to this document, especially 

the following individuals who are members of the biometrics working group. The members are listed in 

the alphabetical order of their organization: Richard Lazarick of Computer Science Corporation; David 

Temoshok of General Services Administration; Fernando Podio and Brad Wing of NIST; and George 

Kiebuzinski and Larry Nadel of Noblis/US-VISIT. 

NIST Handbook 150-25:2009 v 
Foreword 

The NIST Handbook 150 publication series sets forth the procedures, requirements, and guidance for the 

accreditation of testing and calibration laboratories by the National Voluntary Laboratory Accreditation 

Program (NVLAP). The series is comprised of the following publications: 

NIST Handbook 150, NVLAP Procedures and General Requirements, which contains the general 

procedures and requirements under which NVLAP operates as an unbiased third-party accreditation body; 

NIST Handbook 150-xx program-specific handbooks, which supplement NIST Handbook 150 by 

providing additional requirements, guidance, and interpretive information applicable to specific NVLAP 

laboratory accreditation programs (LAPs). 

The program-specific handbooks are not stand-alone documents, but rather are companion documents to 

NIST Handbook 150. They tailor the general criteria found in NIST Handbook 150 to the specific tests, 

calibrations, or types of tests or calibrations covered by a LAP. 

NIST Handbook 150-25 presents technical requirements and guidance for the accreditation of laboratories 

under the NVLAP Biometrics Testing LAP. The handbook is intended for information and use by 

accredited laboratories, assessors conducting on-site visits, laboratories seeking accreditation, laboratory 

accreditation systems, users of laboratory services, and others needing information on the requirements 

for accreditation under this program. All statements in this handbook are meant to supplement NIST 

Handbook 150 and in no means to contradict it. If ambiguity unintentionally arises, the NIST Handbook 

150 requirements are to be followed. 

The 2009 edition of NIST Handbook 150-25 was developed with the participation of technical experts in 

the field of biometrics testing and was approved by NVLAP. The handbook incorporates the release of 

the newest editions of ISO/IEC 17025, General requirements for the competence of testing and 

calibration laboratories, ISO/IEC 17011, Conformity assessment—General requirements for 

accreditation bodies accrediting conformity assessment bodies, NIST Handbook 150, NVLAP Procedures 

and General Requirements, and scopes of accreditation. The requirements of NIST Handbook 150, the 

interpretations and specific requirements in NIST Handbook 150-25, and the requirements set forth by the 

technical standards under the scopes of accreditation have been combined to produce the criteria for 

accreditation in the NVLAP Biometrics Testing LAP. 

This handbook is available on the NVLAP website (http://www.nist.gov/nvlap). 

Questions or comments concerning this handbook should be submitted to NVLAP, National Institute of 

Standards and Technology, 100 Bureau Drive, Stop 2140, Gaithersburg, MD, 20899-2140; phone: 

301-975-4016; fax: 30/1-926-2884; e-mail: nvlap@nist.gov. 

vi NIST Handbook 150-25:2009 
NIST Handbook 150-25:2009 vii 

Introduction 

NIST Handbook 150-25 augments NIST Handbook 150, NVLAP Procedures and General Requirements,

by gathering the technical requirements of the Laboratory Accreditation Program (LAP) for conformance 

testing to biometrics standards, interoperability testing, technology testing, scenario testing, operational 

and usability testing of biometric systems and subsystems based upon nationally and internationally 

recognized biometrics products testing standards. Technical requirements are explained to indicate how 

the NVLAP criteria are applied for accreditation under the Biometrics LAP. 

Any laboratory (including commercial, manufacturer, academic, federal, state, or local government 

laboratory, foreign or domestic) that performs any of the test methods covered by the Biometrics LAP 

may apply for NVLAP accreditation. Accreditation will be granted to a laboratory that complies with the 

conditions for accreditation as defined in NIST Handbook 150. Accreditation does not imply a guarantee 

of laboratory performance or of system-under-testing test data; it is a finding of laboratory competence 

and proficiency in conducting testing. 

Testing services covered: Testing services include conformance testing, interoperability testing, 

technology testing, scenario testing, and operational testing based on nationally and internationally 

recognized biometrics products testing standards to biometrics systems and subsystems. See Annex A of 

this document to view all scopes of accreditation offered and the test procedures and test suites associated 

with it for the Biometrics LAP. 

Types of products covered: The product, generically referred to as the system under tests (SUT) can be a 

part, a collection of parts, (subsystem), or the whole biometric system that has to be relied upon for 

enforcing a closely related set of biometric procedures or rules as defined in the specified standard and/or 

federal policy. 

1 General information 

1.1 Scope 

1.1.1 This handbook specifies the technical requirements and provides guidance for the accreditation of 

laboratories under the NVLAP Biometrics Testing Laboratory Accreditation Program (Biometrics LAP). 

It supplements the NVLAP procedures and general requirements found in NIST Handbook 150, by 

tailoring the general criteria found in NIST Handbook 150 to the specific types of tests covered by the 

Biometrics LAP. 

1.1.2 NIST Handbook 150 and this handbook constitute the collective body of requirements that must 

be met by a laboratory seeking NVLAP accreditation for the Biometrics LAP. 

1.1.3 Any interpretive comments and additional requirements contained in this handbook make the 

general NVLAP criteria specifically applicable to the Biometrics LAP. 

1.2 Organization of handbook 

1.2.1 The numbering and titles of the first five clauses of this handbook are patterned after NIST 

Handbook 150 to allow easy cross-reference. The primary subclauses in clauses 4 and 5 (e.g., 4.1, 4.2, 

etc.) are also numbered and titled to correspond with those of NIST Handbook 150, even when there are 

no additional requirements to those in NIST Handbook 150. 

1.2.2 In addition, the handbook contains two annexes: Annex A (normative) and Annex B 

(informative). Annex A lists the available scopes of accreditation offered by the Biometrics LAP, 

provides additional information and links to the websites where the most current information and 

resources can be found, and discusses additional requirements per specific scopes of accreditation in 

terms of personnel competency, managerial and technical requirements, specific tools, quality manual, 

other documentation, and management systems. 

Annex B presents acronyms and abbreviations found in this handbook. 

1.3 Program description 

1.3.1 The U.S. Department of Homeland Security requested establishment of the Biometrics LAP by 

NVLAP to accredit laboratories that perform conformance testing, interoperability testing, technology 

testing, scenario testing, operational and usability testing for biometrics products (systems and 

subsystems) as defined in nationally and internationally recognized biometrics products testing standards 

of biometric systems and subsystems. The program currently offers accreditation only in the areas where 

a need was expressed and the requirements were provided, but it is designed to expand easily and 

accommodate requests from any interested governmental agency or the private sector. See 1.4, 

References, for a complete list of the currently accepted standards. 

1.3.2 NVLAP reserves the right to expand the Biometrics LAP and offer to interested laboratories 

additional scopes of accreditation not listed in this handbook. Laboratories are advised to review the 

Biometrics LAP’s website for the most current information (see 

http://ts.nist.gov/Standards/Accreditation/bio-lap.cfm). 

NIST Handbook 150-25:2009 1 
1.3.3 All of the biometric testing performed under any of the Biometrics LAP’s scopes is handled by 

third-party test facilities that are accredited as Biometrics Testing laboratories by NVLAP as described in 

this handbook. 

1.3.4 The following diagram provides a generic overview of the accreditation process and the 

relationship between: 

• the Accreditation Authority (NVLAP), 

• the applicant laboratory (third-party laboratory), and 

• the Qualified Product List (QPL) owner and/or Conformity Assessment Council (CAC)-as 

customer and technical requirements provider. 

Figure 1: Accreditation process 

For a summary of the possible alternatives for the biometrics products conformity assessment process, see 

the informative diagrams in Annex A: Figure A.1 and Figure A.2. 

1.4 References 

The following documents are referenced in this handbook. For dated references, only the edition cited 

shall apply. For undated references, the most current edition of the referenced document (including any 

2 NIST Handbook 150-25:2009 
amendments) shall apply within one year of publication or within the time limit specified by regulations 

or other requirement documents. 

See Annex A for additional scope-specific references and, if applicable, a descriptions of Biometrics 

Testing tools relevant to the desired scope of accreditation. 

1.4.1 NVLAP publications 

— NIST Handbook 150, NVLAP Procedures and General Requirements, 

http://ts.nist.gov/Standards/Accreditation/upload/nist-handbook-150.pdf. 

1.4.2 ISO/IEC publications 

In addition to the ISO/IEC references listed in NIST Handbook 150, ISO/IEC references specific to 

particular scopes of accreditation and/or test methods are listed in Annex A. These may be purchased 

from the ISO store at http://www.iso.org. 

— ISO/IEC Guide 43-2, Proficiency testing by inter-laboratory comparisons - Part2: Selection and use 

of proficiency testing schemes by laboratory accreditation bodies, 1997. 

1.4.3 Other publications 

— Registry of USG Recommended Biometric Standards, version 1.0, June 2008 or successors, available 

online at http://www.biometrics.gov/standards. 

1.5 Terms and definitions 

For the purposes of this handbook, the relevant terms and definitions given in NIST Handbook 150 apply 

unless a term is redefined in this handbook. The definitions provided in this handbook are specific to the 

Biometrics LAP, and when applicable, they supersede the definitions given in the NIST Handbook 150. 

For a list of scope-specific terms and definitions, see Annex A. 

1.5.1 

acceptance (of a biometrics product) 

The administrative act by the Procurement Agency of adopting biometrics products for its needs, based 

upon the vendor’s self-declaration of conformity to specified standards and requirements. 

1.5.2 

algorithm 

A limited set of well-defined instructions to solve a task, which leads reliably from a given starting point 

to a corresponding identifiable end point. In biometric systems, specific algorithms are used, for example, 

to indicate how a smart card determines whether the input fingerprint matches the template stored on the 

card or in the database. 

1.5.3 

assessment 

The administrative act by the QPL owner and/or Conformity Assessment Council of determining 

conformance of a biometrics product to specified standards and requirements based, at minimum, on test 

results prepared by the accredited laboratories and submitted by the vendor. 

NIST Handbook 150-25:2009 3 
1.5.4 

authentication 

The process of establishing confidence in the truth of some claim. The claim could be any declarative 

statement for example: “This individual’s name is ‘Joseph K.’” or “This child is more than 5 feet tall.” In 

biometrics, “authentication” is sometimes used as a generic synonym for verification. (See also 

verification.) 

1.5.5 

biometric template 

A digital representation of an individual’s distinct characteristics, representing information extracted from 

a biometric sample. Templates are used during biometric authentication as the basis for comparison. 

1.5.6 

biometrics 

A general term used alternatively to describe a characteristic or a process. 

As a characteristic: 

A measurable biological (anatomical or physiological) and behavioral characteristic that can used for 

automated recognition. 

As a process: 

Automated methods of recognizing an individual based on measurable biological (anatomical or 

physiological) and behavioral characteristics. 

1.5.7 

conformance 

The state of an implementation satisfying the requirements and specifications of a specific standard as 

tested by a test suite or some approved test method. 

1.5.8 

conformance testing 

The testing of an implementation against the requirements specified in one or more standards. 

1.5.9 

conformity assessment 

An activity to determine that a biometrics process, product or service meets referenced standards or 

derived test requirements and fulfills recommended technical requirements. The conformity assessment 

process could imply an acceptance of the biometrics products based upon vendor’s declaration of 

conformity (see 1.5.1), an assessments process which requires conformance test reports revision (see 

1.5.23), or a combination of both acceptance and assessment processes. 

1.5.10 

Conformity Assessment Council (CAC) 

A group of technical experts in biometrics systems and subsystems, whose members are equal in power 

and authority, and whose responsibility is to review the conformity assessment technical requirements and 

to advise the Qualified Product List owner on the accuracy and correctness of the biometrics products test 

reports submitted by vendors with their request to have the product listed on the agency’s QPL. 

4 NIST Handbook 150-25:2009 
1.5.11 

Derived Test Requirements (DTR) 

Description of the methods that will be used by accredited laboratories to test whether the SUT conforms 

to the requirements of the specified standards and the requirements for vendor information that must be 

provided as supplementary evidence to demonstrate conformance to the program specific standard 

requirements. 

1.5.12 

Implementation Guidance (IG) 

A set of documents published during the lifetime of the standard which provides additional clarification, 

testing guidance and interpretations of the standard. (Implementation guidance cannot change or add 

requirements to the standard.) 

1.5.13 

key personnel 

The members of the staff who can perform a particular conformance testing task and who can not be 

replaced by any other laboratory staff member due to their lack of experience, knowledge, or credentials. 

1.5.14 

Personally Identifiable Information (PII) 

Any personal information about an individual, maintained by an agency, including, but not limited to an 

individual’s name; social security number; date of birth; mother’s maiden name; biometric records; 

education; financial transactions; medical history; criminal or employment history; and information which 

can be used to distinguish or trace an individual’s identity. PII can also include address, phone number 

and email address or any combination of indirect data elements such as gender, race, geographic indicator 

(e.g., zip code) which taken in association can identify individuals. 

1.5.15 

procurement agency 

An executive agency responsible for the acquisition of products and services. This document implicitly 

refers to procurement agency for biometrics products. 

1.5.16 

Qualified Product List (QPL) 

A list of products, qualified under the requirements stated in the applicable specification, including 

appropriate product identification and test reference with the name and address of the manufacturer or 

distributor, as applicable. This document only references qualified biometrics products lists. 

1.5.17 

security 

The assurance that a system will maintain an acceptable level of information confidentiality, integrity and 

availability. 

1.5.18 

security requirements 

Functionality and design controls which, when implemented in a system, facilitate information assurance. 

1.5.19 

self-declaration of conformity 

Suppliers declaration, based upon in-house or third-party testing, that the product under assessment 

complies to all referenced standards and additional mandated technical requirements. 

NIST Handbook 150-25:2009 5 
1.5.20 

System-Under-Test (SUT) 

The entity (the product, device, system, sub-system, template, etc.) that is the subject of the conformance 

testing. 

1.5.21 

test method 

The definitive procedure that produces a test result. The test result can be generated by one test or by a 

test suite and can be qualitative (yes/no), categorical, or quantitative (a measured value). The test result 

can be a personal observation or the output of a test tool. 

1.5.22 

traceability 

Interpreted in the Biometrics LAP to mean that the conformance testing tool is traceable back to the 

underlying requirements of the provided normative standards. 

1.5.23 

validation 

The administrative act by the QPL owner and/or Conformity Assessment Council of determining the 

accuracy, standard and/or DTR compliance of the testing tools and/or testing harnesses used by the 

accredited laboratory for the biometrics product testing. When applicable, the validation of a test tool 

implies the verification, as far as possible, that the test tool behaves properly and produces results that 

are consistent with the specifications, with any relevant standards and, if applicable, with a previously 

validated version of the test tool. 

1.6 Program documentation 

1.6.1 General 

This handbook details the Biometrics Program-specific requirements and technical procedures, while it 

interprets, details, and expands portions of NIST Handbook 150 for Biometrics LAP use. Assessors use 

NVLAP checklists to ensure that each laboratory receives an assessment comparable to that received by 

others. Checklists assist assessors in documenting the assessment to the NVLAP requirements found in 

NIST Handbook 150, in this handbook, and in the checklists themselves. Checklists contain definitive 

statements or questions about all aspects of the NVLAP criteria for accreditation, and form part of the OnSite Assessment Report (see NIST Handbook 150). The current version of each checklist is available 

upon request or on the NVLAP website (http://www.nist.gov/nvlap). 

1.6.2 NIST Handbook 150 Checklist 

All NVLAP programs use the NIST Handbook 150 Checklist (formerly called the General Operations 

Checklist), which contains the requirements published in NIST Handbook 150. The checklist items are 

numbered to correspond to clauses 4 and 5 and annexes A and B of NIST Handbook 150. 

1.6.3 NIST Handbook 150-25 Checklist 

1.6.3.1 The NIST Handbook 150-25 Checklist (also referred to as the Biometrics Program-Specific 

Checklist) addresses the requirements specific to biometrics products testing given in NIST Handbook 

6 NIST Handbook 150-25:2009 
150-25. The checklist contains guidance expressed at a more detailed level than found in this handbook. 

The checklist contains the requirements provided in this handbook, including testing requirements and 

additional details and notes for the assessors (e.g., the names of the key personnel) when necessary, with 

an emphasis on observing and performing tests, testing accuracy, instrumentation, calibration, personnel 

competency, and test reporting. The current version of the checklist is available from the Biometrics LAP 

website. 

1.6.3.2 The Biometrics Program-Specific Checklist applies only to biometrics systems and products 

testing. The checklist focuses on the testing requirements and the special personnel and equipment 

requirements corresponding to the scopes of accreditations elected by the applicant laboratory. Annex A 

provides additional information on the scopes of accreditation and derived requirements. 

1.6.3.3 The Biometrics Program-Specific Checklist also includes a place to record the assessor’s 

observations of test demonstrations when performed and/or proficiency testing results when applicable. 

This checklist may be revised when appropriate to reflect changes in the technical requirements, scope(s), 

and/or technology of the program. 

1.6.3.4 The checklist concludes with a Comments and Nonconformities section used by the assessor(s) to 

explicitly identify and describe all nonconformities noted in the body of the checklist. Additionally, the 

assessor(s) may use the form to document comments on any aspect of the laboratory or its performance. 

1.6.4 Scopes of accreditation and test method selection 

1.6.4.1 The Biometrics LAP offers a set of scopes for accreditation. Depending on the breadth of its 

testing capabilities, the applicant laboratory may select its scope(s) of accreditation from the list of 

offered scopes. The minimum required scope of accreditation is the Biometrics Testing and Analysis 

(30/BTA) scope, as defined in the Annex A and on the Biometrics LAP website. Some of the scopes have 

additional scopes as prerequisites. For example, the Technical Interface Standards Conformance Testing 

(30/TISCT) scope requires the Conformance Testing (30/CT) and the Biometrics Testing and Analysis 

(30/BTA) scopes as prerequisites. In this example, neither 30/BTA nor the 30/CT scopes of accreditation 

are stand-alone scopes, therefore there are no separate test methods associated with them. 

1.6.4.2 Each scope of accreditation has at least one test method associated with it. A Test Method 

Selection List is provided to a laboratory seeking accreditation as part of the NVLAP application package 

for the program. 

1.6.5 Test Method Review Summary 

Because of the large number of relevant standards and test methods in the Biometrics LAP, an assessor(s) 

uses the Test Method Review Summary, along with applicable checklists, to review the laboratory’s ability 

to perform the biometrics test methods associated with the scope(s) of accreditation the laboratory is 

applying for. The review of the test methods by the assessor ranges from observing tests while performed 

to having laboratory’s staff describe the test procedures. The assessor notes on the Test Method Review 

Summary the depth into which each part of the test method was reviewed (e.g., Observed Test, Examined 

Apparatus, Walked/Talked Through Test, Listened to Description of Procedures). 

1.6.6 NVLAP Lab Bulletins 

NVLAP Lab Bulletins are issued to laboratories and assessors, when needed, to clarify program-specific 

requirements and to provide information about the most current program additions and changes. 

NIST Handbook 150-25:2009 7 
1.6.7 Other publications 

Some of the scopes of accreditation and associated test methods reference additional documentation that 

can be found in Annex A and/or on the Biometrics LAP website. 

2 LAP establishment, development and implementation 

2.1 Bases for establishment 

This subclause contains no information additional to that provided in NIST Handbook 150, 2.1. 

2.2 Development of technical requirements 

All technical requirements mandated for a laboratory under accreditation tailor the requirements discussed 

in Clauses 4 and 5 which are derived from the elected scope of accreditation and associated test methods 

for which a candidate requests accreditation. 

2.3 Announcing the establishment of a LAP 

This subclause contains no information additional to that provided in NIST Handbook 150, 2.3. 

2.4 Adding to or modifying a LAP 

Upon identifying the need for additional biometrics products tests or test types, NVLAP reserves the right 

to add or modify the Biometrics LAP either by adding new subsidiary programs or new test methods to 

existing programs, or modifying the existing test methods. All changes will be published in a timely 

manner in a NVLAP Lab Bulletin and will be reflected on the website: 

http://www.nist.gov/nvlap. 

2.5 Termination of a LAP 

This subclause contains no information additional to that provided in NIST Handbook 150, 2.5. 

3 Accreditation Process 

3.1 Application for initial accreditation 

3.1.1 A laboratory interested in accreditation for any of the scopes of accreditation offered under the 

Biometrics LAP shall familiarize itself with all the requirements listed in NIST Handbook 150 and in this 

handbook. A laboratory may review the Biometrics LAP website at 

http://ts.nist.gov/Standards/Accreditation/bio-lap.cfm, or contact NVLAP for the most current updates on 

the requirements and application process. 

8 NIST Handbook 150-25:2009 
3.1.2 An overview of the laboratory accreditation process is provided in NIST Handbook 150, clause 3, 

and includes information pertaining to application for accreditation; on-site assessment; proficiency 

testing; accreditation decision; granting accreditation; renewal of accreditation; changes to scope of 

accreditation; monitoring visits; and suspension, denial, revocation, and voluntary termination of 

accreditation. 

3.1.3 Prior to applying to NVLAP for accreditation, a laboratory shall have a fully implemented 

management system. A copy of the latest quality manual and relevant associated documents shall be sent 

to NVLAP with the application forms. 

3.1.4 The assessment process consists of a NVLAP review of the application and laboratory 

management system documentation and an on-site assessment visit. 

3.1.5 For an initial accreditation, NVLAP management may consider a preassessment on-site visit to 

better define the laboratory’s requested scope of accreditation. In such cases, the preassessment costs will 

be charged to the laboratory in addition to the On-Site Assessment Fee. 

3.1.6 The accreditation process starts with the submission of the laboratory’s application and fees 

payment; continues with the on-site visit and laboratory’s proficiency evaluation, which includes the a) 

through d) steps represented below; and ends with NVLAP’s final decision regarding the laboratory’s 

accreditation. 

a) 

b) 

c) 

d) 

Figure 2: Accreditation flow chart 

a) Quality manual evaluation - When the laboratory is applying for initial accreditation, the 

assessor(s) must first determine that the management system meets the requirements. 

NIST Handbook 150-25:2009 9 
b) Proficiency written exam - If the assessor(s) determine that the management system meets the 

requirements, a written exam is then provided to the applicant laboratory, with a 5-business-day 

deadline for response, unless otherwise specified. This exam evaluates the laboratory personnel’s 

technical expertise and knowledge of the standards and test methods applicable to the scope(s) of 

accreditation for which the laboratory is applying. The laboratory shall score greater than 75 % 

correct responses for the accreditation process to continue and the on-site visit to be scheduled. 

c) On-site visit and proficiency/round-table quiz - Once the written exam is passed, an on-site visit is 

scheduled at a mutually agreed date and time. During the on-site visit, the laboratory’s personnel 

will be quizzed and team dynamics observed for proficiency and expertise in the technical area for 

which the laboratory is applying for accreditation. Staff member interaction and knowledge 

distribution among team members are key factors that will be monitored by the assessor(s). The 

laboratory staff shall provide greater than 75 % correct responses for the accreditation process to 

continue. 

d) Proficiency artifact and/or operational exam - Once the assessor(s) determines that the laboratory 

has satisfactorily completed the on-site visit, a proficiency artifact and/or operational exam is 

provided to the applicant laboratory (at the end of the initial on-site visit or after the on-site visit). 

Unless otherwise specified by NVLAP, the laboratory shall complete the test by the scopedependent deadline. The proficiency artifact and/or operational exam is designed to evaluate the 

laboratory’s understanding of and competence to apply the Biometrics Products Testing 

conformance testing methodology specific to the scope(s) of accreditation for which the laboratory 

is applying. The laboratory shall successfully complete the proficiency test as evaluated by the 

assessor(s) and/or an assigned technical expert in order to be accredited by NVLAP. The 

proficiency artifact and/or operational exam requirement applies only to initial accreditation. 

3.2 Activities prior to initial on-site assessment 

3.2.1 Prior to the on-site assessment, the assigned assessor(s) will review all relevant management 

system documentation for conformity with NVLAP requirements, including the requirements of this 

handbook and NIST Handbook 150. During this review, the assessor may request additional management 

system documents and/or records, which will be returned upon request. Because of the very large number 

of relevant standards in the Biometrics LAP, relevant test method(s), operator instructions and/or test 

procedures may be requested by the assessor for review in advance of the on-site assessment. The 

laboratory shall provide requested test method(s), operator instructions and/or test procedures to the 

assessor. 

3.2.2 The quality manual and related documentation shall contain or refer to documentation that 

describes and details the implementation of procedures covering all of the technical requirements in this 

handbook. This information will be reviewed by NVLAP assessors prior to the on-site assessments. 

Satisfactory quality of the manual is a condition for the on-site visit. Defects and recommendations for 

quality manual enhancements will be discussed during the on-site visit. 

3.3 On-site assessments 

3.3.1 Conduct of on-site assessment 

3.3.1.1 The on-site assessment is scheduled at a mutually acceptable date between NVLAP’s assessors 

and the laboratory. The on-site assessment will most likely span about two days and will most likely be 

10 NIST Handbook 150-25:2009 
performed by two or more NVLAP assessors. All observations made by the assessors during the 

assessment are held in the strictest confidence. 

3.3.1.2 In some cases, the on-site assessment may involve the laboratory site and a separate test site for 

the proficiency testing. If the separate test site for the proficiency demonstration is within a short 

commuting distance from the main laboratory site, the demonstration will have to be scheduled at a date 

and time mutually agreed between assessor(s) and laboratory management but still part of the 

approximately two-day on-site visit. If the geographic distance to the separate test site requires significant 

travel, then this is deemed by NVLAP to be a separate laboratory that will have to be separately 

accredited with its own separate on-site assessment, etc. 

3.3.1.3 The assessors will use, in addition to the general checklist based on NIST Handbook 150, the 

Biometrics Program-specific Checklist derived from the technical specifics contained in this handbook 

and the Test Method Review Summary. Even though the Biometrics checklist is derived dynamically 

from the elected scopes of accreditation and corresponding test methods, the derivation is done such that 

the composed checklist ensures that the assessment is complete and that each assessor covers the same 

items at laboratories with equivalent chosen scopes of accreditation. 

3.3.1.4 Additionally, the assigned assessor(s) has the right and the responsibility to go beyond the 

checklist whenever a need arises (e.g., new and updated requirements are available on the Biometrics 

LAP’s website but are not incorporated yet in the checklist), in order to delve more deeply into technical 

issues. 

NOTE NVLAP will document all technical requirements prior to assessments. 

3.3.1.5 The agenda for a typical on-site assessment is given below: 

a) Opening meeting: During the on-site visit, the assessor(s) conduct(s) an entry briefing with 

laboratory management and supervisory personnel to explain the purpose of the on-site and to 

discuss the schedule for the assessment activities. Information provided by the laboratory on the 

accreditation application form may be discussed during this meeting. At the discretion of the 

laboratory manager, other staff may attend this meeting. 

b) Staff interviews: The NVLAP assessor will ask the laboratory manager to assist in arranging times 

for individual interviews with laboratory staff members. The assessor will interview staff members 

filling key positions (e.g., Laboratory Manager, Technical Director, Quality Manager, Authorized 

Representative, Approved Signatories) and staff members who have an effect on the outcome of the 

testing, including staff who conduct the testing. The assessor does not need to talk to all staff 

members; however, the assessor will select staff members representing all aspects of the laboratory. 

These interviews are conducted to determine if the staff members are properly trained, assigned, 

and supervised, and are technically competent for the tasks assigned to them. 

c) Records review: During the on-site visit, the assessor(s) will also review the laboratory’s 

documentation, including: 

• conformance of the management system with ISO/IEC 17025 and NIST Handbook 150, 

• quality manual, 

• equipment and maintenance records; 

• record-keeping procedures, 

NIST Handbook 150-25:2009 11 
• testing procedures, 

• laboratory test reports, 

• personnel competency records, 

• personnel training plans and records, 

• version of the testing tools and/or other conformity assessment specific software, when 

provided; 

• procedures for updating pertinent information (e.g., Implementation Guidance and the qualified 

products list), and 

• safeguards for the protection of confidential, vendor-sensitive and proprietary information. 

 One (or more) laboratory staff member(s) shall be available to answer questions; however, the 

assessor may wish to review the documents alone. Under some circumstances, the assessor may 

remove some documents from the laboratory during the assessment. Specifically, the assessor may 

remove for review documents related to the quality system, such as a revised quality manual, 

proficiency test data, or new procedures. The material will be returned or destroyed at the 

laboratory’s direction. 

 The assessor will check personnel information for job descriptions, resumes, training records and 

technical performance reviews. The assessor shall not be given information which violates 

individual privacy such as salary, medical information, or performance reviews outside the scope of 

the laboratory’s accreditation. At the discretion of the laboratory, a member of its human resources 

department (or equivalent) may be present during the review of personnel information. 

d) Internal audit and management review: The assessor(s) will review and discuss the laboratory’s 

internal audit and management review activities with the laboratory staff. The discussion will 

include all aspects of those activities including the management system procedures, the audit 

findings, the results of the management review, and the actions taken to resolve problems 

identified. 

e) Equipment: The assessor will examine computer hardware, software, auxiliary test equipment, and 

facilities for appropriateness, capability, adherence to specifications, etc. 

f) Laboratory walk-through: The assessor(s) will inspect the laboratory in the following areas during 

a walk-through: 

• physical layout of the laboratory including entrance and exit points; 

• all test equipment and tools, including computer hardware, servers used for records retention 

and physical storage area; 

• work environment in regard to providing adequate testing work space, heating, lighting, etc.; 

and 

• physical security including access control procedures and records. 

g) Proficiency evaluations: Unless otherwise instructed prior to the on-site visit, the proficiency 

artifact will be either provided at the end of the on-site visit or will be sent to the laboratory after 

the on-site visit. NVLAP reserves the right to modify this rule, when appropriate, on a case-by-case 

basis. 

12 NIST Handbook 150-25:2009 
h) Closing meeting: At the end of the on-site visit, a closing meeting is held with the laboratory 

manager and staff to discuss the assessor’s findings. See NIST Handbook 150 for more 

information regarding the assessment report, nonconformities and the final resolution. 

3.3.2 On-site assessment report 

The assessor completes an On-Site Assessment Report which summarizes the findings. Copies of the 

completed checklists are also attached to the report at the closing meeting. The report is signed by the 

assessor and the laboratory’s Authorized Representative. A copy of the report and of the checklists is 

given to the laboratory representative for retention. The decision to grant or renew accreditation is not 

made by the assessment team, but by NVLAP in accordance with the procedures described in NIST 

Handbook 150. 

3.3.3 Nonconformities, comments, and recommendations 

3.3.3.1 Nonconformities that have been corrected during the on-site assessment and any 

recommendations will be specifically noted on the on-site assessment report. 

3.3.3.2 Comments in the on-site assessment report should be given serious consideration by the 

laboratory, but no action is mandated and changes are made at the laboratory’s discretion. However, the 

assessor(s) frequently notes that comments often rise to the level of nonconformities on subsequent 

assessments. 

3.3.3.3 Positive feedback will also be recorded on the on-site assessment report. 

3.4 Proficiency Testing 

3.4.1 General 

3.4.1.1 In addition to the proficiency testing methodology described in the NIST Handbook 150 for 

initial and renewal accreditation, Biometrics LAP mandates program-specific proficiency testing. All 

applicant laboratories are required to participate in proficiency testing for all test methods derived from 

their scope(s) of accreditation, as designated in the Annex A. 

3.4.1.2 To properly evaluate a laboratory, the proficiency testing consists of several parts. The 

proficiency test concept is designed to allow the evaluation of the laboratory’s ability to produce 

repeatable and reproducible test data. 

3.4.1.3 The proficiency testing ranges from observing tests while performed to having laboratory’s staff 

describe the test procedures. The assessor notes on the Test Method Review Summary the depth into 

which each part of the test method was reviewed (e.g., Observed Test, Examined Apparatus, 

Walked/Talked Through Test, Listened to Description of Procedures). See Annex A for more details 

regarding the proficiency testing for each scope of accreditation. 

3.4.2 Types of proficiency testing 

NVLAP follows ISO/IEC Guide 43-2 for all of the types of proficiency testing used within the Biometrics 

LAP, therefore, the LAP’s proficiency testing may consist of one or more of the following exercises: 

NIST Handbook 150-25:2009 13 
a) Demonstration of the understanding and correct interpretation of all data transformation and of all 

test results reported by the test tools. 

b) Demonstration of the reports generation in the approved format and with the content identical to 

the results produced by the tests. 

c) Demonstration of a solid background, theoretical knowledge and technical expertise in the area of 

the elected scope(s) of accreditation. 

d) Demonstration of System-Under-Test (SUT) conformance testing proficiency. Unless otherwise 

instructed, the laboratory will perform a test of a specifically designed artifact, referred to as SUT, 

with one or more features that is/are not in conformance with the standard. The laboratory shall 

discover the nonconformities, document them, and indicate which standard’s requirements have 

failed due to the presence of the nonconformities. 

e) Demonstration of SUT conformance testing proficiency. The laboratory shall perform a 

conformance test of a specially designed artifact, referred to as SUT, with one or more features that 

is/are not in conformance with the standard. The laboratory shall discover the nonconformities, 

document them, and indicate which standard’s requirements have failed due to the presence of the 

nonconformities. 

 Unless otherwise specified by NVLAP, the proficiency artifact and/or operational exam for the 

initial accreditation will be delivered to the laboratory at the end of the on-site assessment or later. 

f) NVLAP, in collaboration with the biometrics Conformity Assessment Council, when applicable, 

considers the test reports submitted to the vendors as on-going proficiency tests. A large number of 

flaws in the reports provided to any vendor and submitted to CAC, when applicable, can trigger the 

laboratory’s suspension or revocation of the accreditation. 

3.4.3 Analysis and reporting 

The results of the proficiency testing are presented by the assessor(s) to NVLAP as soon as the testing 

process is completed. The results are then reported in appropriate documents to the candidate laboratory 

within 30 days from the completion of the testing process. 

3.4.4 Proficiency testing nonconformities 

Problems indicated by proficiency testing will be discussed with appropriate laboratory personnel 

responsible for developing and implementing plans for resolving the problems. Deficiencies identified by 

proficiency testing during an on-site assessment, a scheduled proficiency testing, or submission of 

incomplete or inaccurate test reports shall be resolved by the laboratory in order to attain or maintain 

accreditation. 

3.5 Accreditation decision 

This subclause contains no information additional to that provided in NIST Handbook 150, 3.5. 

14 NIST Handbook 150-25:2009 
3.6 Granting accreditation 

This subclause contains no information additional to that provided in NIST Handbook 150, 3.6. 

3.7 Renewal of accreditation 

It is important to note that the laboratory cannot be granted the renewal of the accreditation unless the 

laboratory has effectively implemented the management system and has produced appropriate records of 

all management system activities, including conducting at least one internal audit and management review 

before initial accreditation. 

3.8 Monitoring visits 

This subclause contains no information additional to that provided in NIST Handbook 150, 3.8. 

3.9 Changes to scope of accreditation 

3.9.1 A laboratory can request at any time a change in its scope of accreditation. A laboratory that 

requests additions to its scope of accreditation might be required to successfully complete additional 

proficiency tests. 

3.9.2 In some instances when the laboratory’s request is to increase the original scope, NVLAP may 

require an on-site assessment. 

3.10 Suspension of accreditation 

3.10.1 Failure to appropriately address and resolve complaints from customers or other interested parties 

may result in NVLAP surveillance activity, additional proficiency testing, and/or suspension or 

revocation of accreditation. 

3.10.2 Significant changes in a laboratory’s key technical personnel or facilities may result in a NVLAP 

monitoring visit(s), and/or suspension of accreditation if the new personnel prove inadequately prepared 

or unsuited for the job. Loss of key personnel without immediate adequate replacement may result in 

laboratory’s suspension. 

3.10.3 If the laboratory does not demonstrate continued competence to perform biometrics conformance 

testing, NVLAP may suspend or revoke the laboratory’s accreditation. The accreditation may be 

suspended or revoked if, any of the following statements is true: 

• 25 % or more of the biometrics products test reports within one year are incorrect, invalid or 

deficient as defined by CAC, when applicable; 

• more than 60 % of the personnel that participated in the latest (re)accreditation process have left 

the laboratory; or 

• nonconformities are found during any on-site visit and are not addressed through corrective 

actions taken by the laboratory. 

NIST Handbook 150-25:2009 15 
3.11 Denial and revocation of accreditation 

This subclause contains no information additional to that provided in NIST Handbook 150, 3.11. 

3.12 Voluntary termination of accreditation 

This subclause contains no information additional to that provided in NIST Handbook 150, 3.12. 

3.13 Appeals 

This subclause contains no information additional to that provided in NIST Handbook 150, 3.13. 

3.14 Conflict of interest 

3.14.1 In order to ensure independence of the testing, neither the candidate laboratory nor other divisions 

within its parent corporation shall provide consulting services for the products that the laboratory tests 

under its NVLAP-accredited status (e.g., develop testing evidence, design advice, etc.). 

3.14.2 For any other services of the laboratory’s parent corporation not listed in the subclause 3.14.1, the 

laboratory shall have an explicit policy and a set of procedures for maintaining a strict separation, both 

physical and electronic, between the laboratory testers and company’s consultant teams, product 

developers, system integrators, and others who may have an interest in and/or may unduly influence the 

testing outcome. The laboratory shall have no financial interest for the work performed under the present 

scope of accreditation other than its conformance testing fees. 

4 Management requirements for accreditation 

4.1 Organization 

4.1.1 The laboratory shall establish and maintain policies and procedures for maintaining laboratory 

impartiality and integrity in the conduct of biometrics products testing. To avoid any conflict of interest, 

the laboratory policies and procedures shall ensure that neither the applicant laboratory nor other divisions 

within its parent organization can perform conformance testing if it is currently providing or has 

previously provided consulting services to the vendor for the SUT (e.g., develop testing evidence, design 

advice). 

NOTE A biometrics laboratory may perform consulting services to provide clarification of the standards, the 

Derived Test Requirements, and other associated documents at any time during the life cycle of the SUT. 

4.1.2 For any other services of the laboratory’s parent organization not listed in 4.1.1, the laboratory 

shall have an explicit policy and a set of procedures for maintaining a strict separation, both physical and 

electronic, between the laboratory testers and company’s consultant teams, product developers, system 

integrators, and others who may have an interest in and/or may unduly influence the testing outcome. 

4.1.3 A biometrics laboratory shall have no financial interest in the work performed under the present 

scope of accreditation other than its conformance testing fees. 

16 NIST Handbook 150-25:2009 
4.1.4 The laboratory shall not perform conformance testing on a module for which the laboratory has: 

• designed any part of the SUT, 

• developed original documentation for any part of the SUT, 

• built, coded or implemented any part of the SUT, or 

• had any ownership or vested interest in the SUT. 

NOTE Provided that a biometrics laboratory has met the other requirements, the laboratory may perform 

conformance testing on SUT produced by a company when: 

• the laboratory has no ownership in the company, 

• the laboratory has a completely separate management from the company, and 

• business between the biometrics laboratory and the company is performed under contractual agreements, as 

done with other clients. 

4.1.5 A biometrics product testing laboratory may take existing vendor documentation for an existing 

SUT (post-design and post-development) and consolidate or reformat the existing information (from 

multiple sources) into a set format. If this occurs, the vendor shall be notified of this action when the 

conformance test report is submitted. 

4.1.6 For additional guidance on laboratory organization, and interpretations and clarifications 

concerning conflict of interest and strategies for avoiding it, the laboratory shall also consult the guidance 

provided by CAC, when applicable. If any discrepancy in the provided information regarding the 

accreditation process and/or conflict of interest arises, NVLAP’s guidance supersedes the documentation 

provided by CAC. 

4.2 Management system 

4.2.1 The laboratory shall complete the cross-reference section of the applicable checklists allowing the 

laboratory and the NVLAP assessor(s) to verify that all requirements of this handbook and NIST 

Handbook 150 are addressed and their locations clearly identified in the management system 

documentation. 

4.2.2 The management system shall provide policy and procedures to ensure routine checks of the 

competence of the staff involved in the conduct and evaluation of the biometrics products testing. 

4.3 Document control 

4.3.1 Data collected for biometrics testing is also identified as “Personally Identifiable Information” 

(PII) and shall be properly collected, stored, transported, transmitted and disposed of such that the 

information is not disclosed to unauthorized parties. PII information can include both paper and electronic 

formats in any information system. 

4.3.2 The laboratory shall implement policies and procedures for handling and properly safeguarding 

the PII that address safeguarding data at rest, properly protecting any PII data in transfer, and disclosure 

NIST Handbook 150-25:2009 17 
of any PII data. The policies and procedures should be in compliance with all federal laws (e.g., Privacy 

Act of 2005; Information Protection and Security Act; Identity Theft Prevention Act of 2005; etc.) and 

state laws (e.g., Massachusetts’ Public Records Law and Fair Information Practices Act; California law 

no. SB 1386 of September 25, 2002) that address “acceptable uses” of PII and shall be included in the 

quality manual and/or related documents. 

NOTE As a safe harbor, laboratories could limit the risk of PII disclosure by: 

• unless encrypted, prohibiting mobile devices use for storing, transferring or transmitting PII data; 

• implementing multi-factor authentication for access to the PII data when remote access to the database 

cannot be avoided; 

• encrypting the databases that contain PII, whenever database size permits it; 

• when database size does not allow full data encryption, splitting PII data into indirect data elements that 

cannot identify individuals when stored in separate databases. 

4.3.3 When applicable, the quality manual and related documentation shall include procedures and 

policies for handling software and maintaining the software’s integrity according to the copyright and 

secrecy status. 

4.4 Review of requests, tenders and contracts 

4.4.1 The contract review shall be conducted to ensure that a laboratory is capable of providing the 

service, and that the requirements, rights, and responsibilities of the parties are understood. 

4.4.2 If the laboratory conducts testing at client sites or any selected site other than the laboratory’s site 

accredited for conformance testing, the site shall meet all requirements pertinent to the conformance 

testing of the SUT as the accredited testing laboratory. 

NOTE The laboratory may use checklists and/or contract agreements to satisfy this requirement. 

4.4.3 The laboratory shall establish and maintain documented procedures for the review of contracts 

between the laboratory and clients. Policies for document storage and maintenance of contract under 

confidentiality or non-disclosure agreements, marked as secret, or copyright protected, shall be defined 

according to the document’s status. These documents shall be protected commensurate with their 

classification and/or sensitivity, and access to them shall be given only to authorized personnel. 

4.4.4 The testing laboratory and client shall agree in writing what constitutes the SUT and what 

constitutes the environment within the SUT. For this program, the environment includes, but is not 

limited to: 

• the specific test platform, 

• the test configuration, and 

• the external environment. 

18 NIST Handbook 150-25:2009 
4.5 Subcontracting of tests and calibrations 

If subcontracting is used as a mechanism by which the laboratory fulfills and/or enhances the 

conformance testing process, the laboratory shall employ either services provided by NVLAP-accredited 

laboratories or by laboratories that satisfy all testing requirements as indicated in NIST Handbook 150, 

NIST Handbook 150-25, and all documents provided by CAC, when applicable. In the latter instance, the 

subcontracting laboratory: 

a) shall justify the selection explaining why this particular subcontractor was selected and how the 

subcontractor satisfies the testing requirements, and 

b) shall assume full responsibility for the outcome of the conformance testing performed by the 

subcontractor. 

4.6 Purchasing services and supplies 

There are no requirements additional to those set forth in NIST Handbook 150. 

4.7 Service to the customer 

There are no requirements additional to those set forth in NIST Handbook 150. 

4.8 Complaints 

There are no requirements additional to those set forth in NIST Handbook 150. 

4.9 Control of nonconforming testing and/or calibration work 

There are no requirements additional to those set forth in NIST Handbook 150. 

4.10 Improvement 

There are no requirements additional to those set forth in NIST Handbook 150. 

4.11 Corrective action 

There are no requirements additional to those set forth in NIST Handbook 150. 

4.12 Preventive action 

There are no requirements additional to those set forth in NIST Handbook 150. 

NIST Handbook 150-25:2009 19 
4.13 Control of records 

4.13.1 General 

4.13.1.1 The laboratory shall maintain a functional record-keeping system for each client. Records shall 

be readily accessible and complete. Digital media shall be logged and properly marked, and they shall be 

properly and securely backed-up. Entries in paper-based laboratory notebooks shall be dated and signed 

or initialed. 

4.13.1.2 Digital records shall contain entries of pertinent staff/date information for data as required in 

the quality manual and, as an established safeguard, shall have means to preserve integrity of records, and 

shall have means for maintenance without later unauthorized modifications. 

4.13.1.3 Software and data protected by non-disclosure agreements or classified as confidential shall be 

stored according to the vendor and/or government requirements and commensurate with the data 

sensitivity, and access shall be granted only to the authorized personnel. An access log file shall be 

maintained. 

4.13.1.4 The testing laboratory shall take steps to ensure that no third party can gain access to on-line 

records or to hard copies of the records, either during, or after testing. 

4.13.1.5 If a client’s system on which testing is conducted is potentially open to access by third parties, 

the testing laboratory shall ensure that the client controls the testing environment so that the third parties 

do not gain access to that system during testing. 

4.13.1.6 Records of all management system activities, including training, internal audits, and 

management reviews, shall be securely saved for future reviews. The integrity of electronic documents 

shall be assured by means commensurate with the data sensitivity. Documents in hard copy form shall be 

marked and stored in a secure location. If necessary to preserve a document’s integrity and prevent 

unauthorized changes, a file logging any access, change, or addition to the document shall be maintained. 

4.13.1.7 Laboratories shall maintain records of the configuration of test equipment and all analyses to 

ensure the suitability of test equipment to perform the desired testing. 

4.13.2 Technical records 

4.13.2.1 During the on-site assessment, the records that will be reviewed include, but are not limited to: 

a) staff training dates and competency reviews; 

b) conformity assessment software versions and updates, when applicable; 

c) versions and updates of mandated testing tools; 

d) documentation for mandated testing tools; 

e) statement of security policy; 

f) conditions for testing when applicable; 

20 NIST Handbook 150-25:2009 
g) test equipment and instrumentation calibration (software documentation updates, if applicable); 

h) acceptance/rejection of biometrics systems or components submitted for test; 

i) comprehensive logs for tracking samples and test activities; 

j) records of problems with test equipment or system(s), records that demonstrate such equipment or 

system(s) were removed from service, records of repairs or resolution of problems; 

k) test data (including any diagrams, algorithm test suites, photos, and graphic images) and official 

reports; 

l) correspondence files including questions submitted and responses. 

4.13.2.2 The final test results and/or the test reports generated for the SUT, using biometrics testing 

tools or biometrics data, shall be kept by the laboratory following the completion of testing for the life of 

the SUT, or as specified by the client in writing. Records may include hard or digital copies of the official 

test results and the test results error file(s). 

4.14 Internal audits 

4.14.1 The internal audit shall cover compliance with NVLAP, laboratory management system, 

contractual, testing, and test method requirements. 

4.14.2 An applicant laboratory shall conduct at least one complete internal audit, including the test 

methods that are requested to be on the laboratory’s scope of accreditation, prior to the first on-site 

assessment. The internal audit report and pertinent records will be reviewed by the NVLAP assessor 

before or during the pre-accreditation on-site assessment. 

4.14.3 For accredited laboratories, reports and pertinent records for internal audits conducted since the 

previous on-site assessment shall be made available for review during the on-site assessment. 

4.14.4 Internal audits are separate and distinct from management reviews (see 4.15). 

4.15 Management reviews 

4.15.1 Periodic reviews of the management system shall reflect adherence to NVLAP requirements and 

the laboratory’s quality objectives. 

4.15.2 Management reviews shall review all nonconformities and may reflect positive aspects of the 

management system. 

4.15.3 An applicant laboratory shall perform at least one complete management review prior to the first 

on-site assessment. The management review report(s) and pertinent records will be reviewed by the 

NVLAP assessor before or during the pre-accreditation on-site assessment. 

4.15.4 For accredited laboratories, reports and pertinent records for management reviews conducted 

since the previous on-site assessment shall be made available for review during the on-site assessment. 

NIST Handbook 150-25:2009 21 
5 Technical requirements for accreditation 

5.1 General 

There are no requirements additional to those set forth in NIST Handbook 150. 

5.2 Personnel 

5.2.1 The laboratory shall maintain competent administrative and technical staff that are: 

a) knowledgeable of all biometrics standards and publications listed as references in this handbook 

pertaining to the specific tests found on the laboratory’s scope(s) of accreditation; 

b) familiar with the biometrics terminology, biometrics modalities, biometrics systems and subsystems; 

c) familiar with the “acceptable use” (collection, storage, handling, etc.) of the PII as described in the 

federal and state laws; 

d) familiar with the biometrics products testing protocols, procedures and tools, when applicable; 

e) familiar with human-crew interaction and human-crew rights and responsibilities, when applicable. 

5.2.2 The laboratory shall maintain a list of personnel designated to fulfill NVLAP requirements 

including: 

a) laboratory’s director; 

b) Authorized Representative; 

c) Approved Signatories; 

d) team leaders; 

e) key technical persons in the laboratory. 

NOTE Significant changes in a laboratory’s key technical personnel or facilities may result in a NVLAP 

monitoring visit, and/or suspension of accreditation if the new personnel or facilities prove to be inadequate. 

5.2.3 The laboratory shall identify a staff member as quality manager with overall responsibility for 

quality assurance and for maintenance of the quality manual. An individual may be assigned or appointed 

to serve in more than one position; however, to the extent possible, the laboratory director and the quality 

manager positions should be independently staffed. 

5.2.4 The quality manager shall receive management system training, preferably in ISO/IEC 17025. If 

training is not available in ISO/IEC 17025, training should be acquired in the ISO 9000 series, especially 

ISO 9001, or equivalent with particular emphasis on internal auditor training. 

22 NIST Handbook 150-25:2009 
5.2.5 Laboratories shall document the required qualifications for each staff position. The staff 

information may be kept in the official personnel folders or in separate folders that contain only the 

information that the NVLAP assessors need to review. 

5.2.6 The laboratory key technical personnel who conduct biometrics products testing activities shall 

have at least a Bachelor of Science in Computer Science, Computer Engineering, Electrical Engineering, 

Human Factors or similar technical discipline or equivalent experience. (For more details regarding the 

staff members’ required expertise for biometrics products conformity assessment, see Annex A.) 

5.2.7 Laboratory staff collectively shall have knowledge of or experience in the following areas: 

a) biometrics modalities available; 

b) design/analysis of biometrics systems and sub-systems; 

c) database systems; 

d) biometrics products testing protocols and procedures; 

e) biometrics data structures; 

f) biometrics standards and special publications referenced in this handbook; 

g) familiarity with operating systems under which the biometrics systems are operating; 

h) any specific technology upon which testing is conducted. 

5.2.8 The laboratory shall have documented a detailed description of its training program for new and 

current staff members. Each new staff member shall be trained for assigned duties. The training program 

shall be updated and current staff members shall be retrained when relevant standards or scope of 

accreditation changes, or when the individuals are assigned new responsibilities. Each staff member may 

receive training for assigned duties either through on-the-job training, formal classroom study, attendance 

at conferences, or another appropriate mechanism. Training materials that are maintained within the 

laboratory shall be kept up-to-date. 

5.2.9 The laboratory shall have a competency review program and procedures for the evaluation and 

maintenance of the competency of each staff member for each test method the staff member is authorized 

to conduct. An evaluation and an observation of performance shall be conducted annually for each staff 

member by the immediate supervisor or a designee appointed by the laboratory director. A record of the 

annual evaluation of each staff member shall be dated and signed by the supervisor and the employee. A 

description of competency review programs shall be maintained in the management system. 

5.2.10 If the mechanism by which the laboratory employs staff members is through contracting, any key 

personnel who are contractors shall be identified and listed in the laboratory’s application for 

accreditation. When a change in the key personnel employed through contracting occurs or when the 

direct supervision of this category of personnel is not possible, a report shall be submitted to NVLAP. 

NOTE Any of the above-listed changes in the personnel employed through contracting can affect a laboratory’s 

accreditation status. 

NIST Handbook 150-25:2009 23 
5.2.11 NVLAP does not make a distinction between laboratory employees and individuals hired under a 

contracting agreement. NVLAP requires that the laboratory maintain responsibility for and control of any 

work performed within its scope of accreditation. To that end, the laboratory shall ensure all individuals 

performing evaluation activities satisfy all NVLAP requirements, irrespective of the means by which 

individuals are compensated (e.g., the laboratory shall ensure all test personnel receive proper training 

and are subject to annual performance reviews, etc.). 

5.2.12 The laboratory personnel who handle PII documents shall obey all laboratory policies and 

procedures that implement the federal and state privacy laws that stress the “acceptable uses” of PII. 

5.2.13 For additional personnel requirements that are specific to a scope of accreditation or test method, 

see Annex A. 

5.3 Accommodation and environmental conditions 

5.3.1 The laboratory shall have adequate facilities to meet the requirements for NVLAP accreditation. 

This includes facilities for security conformance testing, record-keeping, document storage, and hardware 

and software storage. The laboratory shall have access to staff training facilities. 

5.3.2 A protection system shall be in place to safeguard customer proprietary hardware, software, test 

data, electronic and paper records, and other materials. This system shall protect the proprietary materials 

and information from personnel outside the laboratory, visitors to the laboratory, laboratory personnel 

without a need to know, and other unauthorized persons. Laboratories shall have systems (e.g., firewall, 

intrusion detection) in place to protect internal systems from unauthorized, malicious external entities. If 

testing activities are conducted at more than one location, all locations shall meet NVLAP requirements 

and mechanisms shall be in place to ensure secure communication between all locations. 

5.3.3 If the laboratory is conducting multiple simultaneous test campaigns, it shall maintain a system of 

separation between the products of different customers and between different products. This includes the 

product being tested, the test platform, peripherals, documentation, electronic media, manuals, and 

records. 

5.3.4 The laboratory shall meet the equipment and environment requirements specific to biometrics 

testing specified in the test methods. 

5.3.5 If testing activities will be conducted outside of the laboratory, the management system shall 

include appropriate procedures for testing activities at customer sites or other off-site locations. For 

example, customer site procedures may explain how to secure the site, where to store records and 

documentation, and how to control access to the test facility. 

5.3.6 If the laboratory is conducting its testing at the customer site or other location outside the 

laboratory facility, the environment shall conform, as appropriate, to the requirements for the laboratory 

environment. If a customer’s system on which a testing is conducted is potentially open to access by 

unauthorized entities during testing, the test laboratory shall control the environment. This is to ensure 

that the systems are in a defined state compliant with the requirements for the tests before starting to 

perform test work and that the systems ensure that unauthorized entities do not gain access to the system 

during testing. 

24 NIST Handbook 150-25:2009 
5.3.7 For additional accommodation and environmental conditions requirements that are specific to a 

scope of accreditation or test method, see Annex A. 

5.4 Test and calibration methods and method validation 

5.4.1 General 

Tests may be conducted at the client or laboratory site or at another mutually agreed upon site. When 

testing is performed at a client site, all NVLAP requirements pertaining to equipment and environment as 

they apply to the tests shall apply. Moreover, only the personnel of the NVLAP-accredited laboratory 

shall perform all actions necessary to administer the tests and record the results, including the loading, 

compiling, configuring, and execution of any of the mandated testing tools. 

5.4.2 Selection of methods 

Laboratories shall use the test methods and tests derived from their scopes of accreditation. For more 

specific information regarding methods selection for each scope of accreditation, see Annex A. 

5.5 Equipment 

5.5.1 For its scope of accreditation, the laboratory shall have appropriate hardware, software, and 

computer facilities to conduct biometrics testing. This includes but is not limited to: 

a) required software test suites; 

b) testing equipment for physical tests; 

c) all special equipment necessary to perform all tests derived from the most current version of the 

standard. 

5.5.2 The equipment used for conducting biometrics testing shall be maintained in accordance with the 

manufacturer’s recommendations or in accordance with internally documented laboratory procedures, as 

applicable. Test equipment refers to software and hardware products or other assessment mechanisms 

used by the laboratory to support the biometrics testing of the SUT. 

5.5.3 When applicable, the laboratory shall own, load and run testing tools provided or validated by an 

institution indicated by the CAC, and produce test results using such tools, wherever appropriate. When 

the testing tool is recommended or provided by CAC, the tool may not be altered or changed and shall not 

be distributed outside the laboratory. A list of the mandated testing tools for each scope of accreditation is 

provided in Annex A and/or the Biometrics LAP website. 

5.5.4 When applicable, a testing laboratory shall have procedures defining the test to be performed 

whenever major or minor changes are made to any testing tool. This is necessary to ensure that 

harmonization is maintained as appropriate with other testing laboratories and that correctness is 

maintained with respect to the relevant standard(s) or specification(s). 

5.5.5 When a given test tool or equipment configuration must be used but there are no suitable 

validation services available outside the testing laboratory to which validation is applicable, and no 

suitable reference implementation that could be used by the testing laboratory to validate the test tool or 

NIST Handbook 150-25:2009 25 
equipment configuration, then the testing laboratory shall define and document the procedures and 

methods that it uses to check on the correct operation of the test tool or equipment configuration. 

5.5.6 For additional equipment requirements that are specific to a scope of accreditation or test method, 

see Annex A. 

5.6 Measurement traceability 

5.6.1 General 

For Biometrics Testing, “traceability” is interpreted to mean that the assessment test tools and test 

harnesses shall be traceable back to the underlying requirements of the normative standards listed in 1.4 

and Annex A, and on the Biometrics LAP website. This means that each abstract test case and its 

evaluation methodology are traceable to specific biometrics requirements listed in the governing 

documentary standard, and that they are achieved via the assertions and associated Derived Test 

Requirements documented in the testing tool in use. 

5.6.2 Calibration 

5.6.2.1 Test tools 

5.6.2.1.1 For biometric and security testing purposes, calibration means verification of correctness 

and suitability. Any test tool used to conduct biometrics testing and which is not part of the SUT shall be 

evaluated in isolation to make sure it correctly represents and assesses the test assertions it claims. When 

possible, test tools should also be examined to ensure that they do not interfere with the conduct of the 

test and do not modify or impact the SUT. Software testing tools, by necessity, alter the runtime 

environment in which the SUT performs. Therefore, such tools should be examined to ensure minimum 

impact to the SUT. 

5.6.2.1.2 Laboratories shall maintain records of the configuration of test equipment and all analyses to 

ensure the suitability of test equipment to perform the desired testing. 

5.6.2.2 Test equipment 

5.6.2.2.1 The equipment used for conducting the conformance tests shall be maintained and 

recalibrated in accordance with the test tool author’s recommendation, if applicable; as specified in the 

test method; or annually, whichever results in shorter time periods between calibrations. 

5.6.2.2.2 The reference standards used and the environmental conditions at the time of calibration 

shall be documented for all calibrations. Calibration records and evidence of the traceability of the 

reference standards used shall be made available for inspection during the on-site visit. 

5.6.3 Testing 

5.6.3.1 When applicable, confirmation of the most current version of testing tools shall be assured before 

conducting a test. This may be accomplished through configuration management for all hardware and 

software, or through software version control. Records shall be kept of the date and extent of all 

hardware and software upgrades and updates. 

26 NIST Handbook 150-25:2009 
5.6.3.2 Laboratories shall use the test methods in specific test methodology standards or DTRs. When 

exceptions are deemed necessary for technical reasons, the client shall be informed and details shall be 

described in the test report. Substantive documentation shall be provided on exceptions taken to the test 

method and DTRs to ensure that the correct and required precision and interpretation of the test assertion 

is maintained. When necessary, these reports may be used to update abstract test cases, the testing tool 

when applicable, and its accompanying documentation. 

5.6.3.3 For more details on the specific test methods corresponding to different scopes of accreditation, 

see Annex A and the Biometrics LAP website (http://ts.nist.gov/Standards/Accreditation/bio-lap.cfm). 

5.7 Sampling 

5.7.1 If a laboratory applies for biometrics scopes of accreditation that involve testing with human 

subjects, the laboratory shall implement policies and procedures that: 

a) protect the physical and psychological well-being of the human subjects during testing, 

b) serve as a safeguard to protect against errors in ethical judgment, 

c) assure human subject testing is in compliance with Part 27 of Title 15 of the Code of Federal 

Regulations. 

5.7.2 The laboratory shall submit all policies and procedures defining biometrics products testing with 

human subjects and all test suites used for this category of biometrics products testing to an Institutional 

Review Board (IRB) for review and provide proof of IRB approval. 

5.7.3 The laboratory shall ensure that the disposition of any intellectual property generated via the 

sampling of biometrics data from human subjects is compatible with each testing methodology standard, 

or DTR, and that it complies with vendor’s requirements when applicable. 

5.8 Handling of test and calibration items 

5.8.1 Laboratories shall protect all products under testing and test tools from modifications of any kind 

and unauthorized access and use. Laboratories shall ensure that export-controlled equipment, such as 

fingerprint scanners, is protected in accordance with Federal Export Administration Regulations (EAR). 

5.8.2 When the SUT consists of software components, the laboratory shall ensure that a configuration 

management is in place to prevent unauthorized modifications. This configuration management shall 

uniquely identify each software component of the SUT and control and document modifications to any of 

the software components. 

5.9 Assuring the quality of test and calibration results 

There are no requirements additional to those set forth in NIST Handbook 150. 

NIST Handbook 150-25:2009 27 
5.10 Reporting the results 

5.10.1 General 

The laboratory shall issue test reports of its work which accurately, clearly, and unambiguously present 

the test conditions, the test setup when varies from the standard protocol, the test results, and all other 

information necessary to reproduce the test. Any deviations or omissions from the standard shall be 

clearly indicated. Test reports to clients shall meet contractual requirements in addition to meeting the 

requirements of NIST Handbooks 150 and 150-25, governing ANSI/INCITS, FIPS and other standards. 

Test reports shall provide all necessary information to permit reproduction of the test and to obtain 

consistent results. 

5.10.2 Test reports 

5.10.2.1 If a NIST/ITL-supplied test report tool or other reporting methodologies are provided, the 

laboratory shall follow those requirements and use those supplied test tools. 

5.10.2.2 Whenever test cases are such that an analysis of the observations by the testing staff is 

required in order to interpret the results before stating them in a test report, the testing laboratory shall 

have objective procedures to be followed by the test operators performing the analysis, sufficient to 

ensure that the repeatability, reproducibility, and objectivity of the test results can be maintained. 

5.10.2.3 Test reports bearing the NVLAP symbol may be written for more than one purpose: 

a) Reports that are produced under contract and intended for use by the client 

 Reports intended for use only by the client shall meet client/laboratory contract obligations and be 

complete, but need not necessarily meet all conformity assessment requirements. 

b) Reports to be submitted to the vendors for biometrics product conformity assessment 

 Conformity assessment test reports intended for submission by vendors to CAC or to any institution 

designated by CAC shall meet the requirements of the associated DTRs and IG when applicable, as 

well as the requirements of NIST Handbook 150, NIST Handbook 150-25 and any other 

programmatic documentation guidance. 

5.10.3 Electronic transmission of conformity assessment test results 

5.10.3.1 A laboratory may submit either a printed or an electronic report as instructed by the vendor. 

The electronic version shall have the same content as the printed reports and shall be generated using a 

software application that is acceptable to CAC if the vendor intends to submit the test results for 

assessment. A controlled copy of the report shall be placed in the laboratory’s records. A mechanism that 

ensures the control copy’s integrity and confidentiality commensurable with the data sensitivity and/or 

programmatic requirements shall exist. 

5.10.3.2 The laboratory shall provide an integrity and confidentiality mechanism commensurable 

with the data sensitivity and/or programmatic requirements and/or government requirements when 

electronic delivery of the test reports to the vendor is employed. Confidentiality mechanisms shall be 

employed to ensure that the test report cannot be disclosed to anyone other than the intended recipient(s), 

while an integrity mechanism shall exist to ensure that the test report is not maliciously modified. 

28 NIST Handbook 150-25:2009 
5.10.4 Amendments to test reports and calibration certificates 

5.10.4.1 For test reports created for assessment purposes by CAC or any institution designated by 

CAC, the laboratory shall issue corrections or additions to a test report only by a supplementary document 

that is suitably marked and that meets CAC’s requirements. 

5.10.4.2 For test reports created for purposes other than official SUT assessment, the laboratory shall 

issue corrections or additions to a test report only by a supplementary document suitably marked; e.g., 

“Supplement to test report serial number [...]”. If the change involves a test assertion, this document shall 

specify which test assertion is in question, the content of the result, the explanation of the result, and the 

reason for acceptance of the result. 

6 Additional requirements 

Annex A contains additional information and requirements for specific scopes of accreditation. 

NIST Handbook 150-25:2009 29 
Annex A 

(normative) 

Scopes of accreditation – additional information and requirements 

A.1 Additional general information 

Annex A provides additional information and requirements as they pertain to each scope of accreditation. 

Section A.2 describes the scopes of accreditation available under the Biometrics LAP, and supplements 

the references provided in 1.4 and the terms and definitions in 1.5 with the scope-specific information. 

Sections A.3, A.4 and A.5 are structured to map to clauses 3, 4, and 5 of the handbook and provide, where 

applicable, the necessary information and requirements for a scope of accreditation (e.g., A.3.4, 

“Additional proficiency testing requirements,” supplements 3.4, “Proficiency testing”). Scope subheadings are shown only if there is additional information or requirements for a scope; otherwise there 

will be no separate entry for the scope. 

To make a clear distinction between the accreditation program and the conformity assessment program 

and to emphasize the separation of duties for each key player in these processes, NVLAP is including 

here two informative diagrams (figures A.1 and A.2) of the conformity assessment process, with two 

different operational scenarios, and illustrating the relationships between: 

• the Procurement Agency and/or Conformity Assessment Council, 

• the third-party laboratory, and 

• the consumers (e.g., U.S. Government agencies). 

Figure A.1. Assessment process – with maintained QPL 

30 NIST Handbook 150-25:2009 
Figure A.2. Acceptance process (based on Supplier’s Declaration of Conformity, no QPL) 

A.2 Scopes of accreditation, test methods, additional references, terms and conditions 

A.2.1 Scope of accreditation 

A.2.1.1 NVLAP offers to all interested laboratories a flexible, dynamic system of selecting a compound 

scope of accreditation under the Biometrics LAP that best fits a laboratory’s level of equipment and 

expertise. The minimum level of required expertise for all biometric scopes of accreditation is described 

as “Biometrics Testing and Analysis (30/BTA)” testing and is considered the foundation of all scopes of 

accreditations for the Biometrics LAP. 

A.2.1.2 A chained list showing all currently offered scopes of accreditation, marked by a checked box 

(7,) is presented below. The requirements for scopes that are marked by an unchecked box () will be 

developed and published in future editions of this handbook. For the most current information on scopes 

available, see the Biometrics LAP website (http://ts.nist.gov/Standards/Accreditation/BIO-LAP.cfm). 

The list indicates that the election of any descendent scope of accreditation mandates the election of all 

scopes of accreditation listed above it in the chain. For example, the selection of the Data Interchange 

Standards Conformance Testing (30/DIST) scope mandates, as prerequisites, Conformance Testing 

(30/CT) and Biometrics Testing and Analysis (30/BTA) scopes as well. 

NIST Handbook 150-25:2009 31 
7 30/BTA Biometrics Testing and Analysis 

7 30/CT Conformance Testing 

 7 30/TISCT Technical Interface Standards Conformance Testing 

 7 30/DISCT Data Interchange Standards Conformance Testing 

7 30/ST Scenario Testing – Human Crew (Laboratory) 

 7 30/SLT System Level Testing (enrollment/verification) 

7 30/CPST Conformance to Performance Specifications Testing 

7 30/GPT Graded Performance Testing 

 30/PPT Pure Performance Testing 

  30/BSCT Biometric Sample Collection Testing 

 30/IT Interoperability Testing 

  30/SIT Sensors Interoperability Testing 

  30/MTMIT Modality-Specific Template/Matcher Interoperability Testing (one-to-one or 

one-to-many) 

 30/TT Technology Testing – Non-human/Laboratory 

  30/MMAPT Modality-Specific Matcher Algorithm Performance Testing 

  30/STT Sensors Technology Testing 

  30/SIQAT Sensor Image Quality Algorithm Testing 

  30/BIST Biometric Image Segmentation Testing 

  30/DCST Data Compression Software Testing 

 30/OT Operational Testing 

 30/UT Usability Testing 

Figure A.3 gives a graphical representation of the list presented above. 

32 NIST Handbook 150-25:2009 
Figure A.3. Scopes of accreditation 

Legend: 

30/ = NVLAP code for Biometrics Products Testing, which appears as the first 

two digits in each NVLAP test method code. 

BTA = Biometric Testing and Analysis 

CT = Conformance Testing 

TISCT = Technical Interface Standards Conformance Testing 

DISCT = Data Interchange Standards Conformance Testing 

ST = Scenario Testing – Human Crew (Laboratory) 

SLT = System Level Testing (enrollment/verification) 

CPST = Conformance to Performance Specifications Testing 

GPT = Graded Performance Testing 

PPT = Pure Performance Testing 

BSCT = Biometric Sample Collection Testing 

IT = Interoperability Testing 

SIT = Sensor Interoperability Testing 

MTMIT = Modality-Specific Template/Matcher Interoperability Testing 

TT = Technology Testing – Non-human/Laboratory 

MMAPT = Modality-Specific Matcher Algorithm Performance Testing 

STT = Sensor Technology Testing 

SIQAT = Sensor Image Quality Algorithm Testing 

BIST = Biometric Image Segmentation Testing 

DCST = Data Compression Software Testing 

OT = Operational Testing 

UT = Usability Testing 

NIST Handbook 150-25:2009 33 
A.2.1.3 Table A-1 provides a listing of products, together with their definitions, that are or will be 

addressed by NIST Handbook 150-25. This table is intended to illustrate that testing of biometric 

products may be performed at various levels or combinations, such as components, modules, subsystems 

or systems. The product types are broad categories that span different modalities and media. The products 

listed below are representative, and are not necessarily all-inclusive. 

Table A-1. Tested biometric subsystems, devices and/or modules 

Item Product Type Function 

1 Biometric Capture Device (all 

modalities; ten-print, single finger, 

face, iris, etc.) 

Biometric Device Device that captures image (sample) data 

for use by biometric subsystem 

2 Biometric Template Generator (all 

modalities; fingerprint, face, iris, etc.) 

Biometric 

Software Module 

Software that generates a template from an 

image (sample) [(also known as feature 

extractor] 

3 Template matcher (all modalities; 

fingerprint, face, iris, etc.) 

Biometric 

Software Module 

Software that matches a sample template 

with a stored template 

4 Matcher decision software module Biometric 

Software Module 

Software that makes a decision based on 

the matcher score(s) or classification 

decision 

5 Biometric Data Segmenter (all 

modalities; ten-print, face, iris, etc.) 

Biometric 

Software Module 

Software that extracts and categorizes 

useful part(s) of a raw input sample (e.g. 

fingerprint segmenter, face 

finder/extractor) 

6 Biometric Sample Quality Software -

Image Data Quality (all modalities; 

ten-print, single finger, face, iris, etc.) 

Biometric 

Software Module 

Software that computes metrics indicating 

quality of biometric image (sample) 

7 Biometric sample compression 

module 

Biometric 

Software Module 

Software that compresses a biometric 

sample (image data) 

8 Enrollment Subsystem (all modalities; 

ten-print, single finger, face, iris, etc.) 

(portable or stationary) 

Biometric 

Subsystem 

Subsystem that captures biometric samples 

and meta-data (e.g., biographic data), 

determines sample quality (if required), 

formats the data for use by the other 

systems (e.g., Identity Management 

System [IDMS]), and compresses the data 

(if required). 

9 Verification Subsystem (all 

modalities; fingerprints, face, iris, 

etc.) 

Biometric 

Subsystem 

Subsystem that captures biometric 

samples, matches the sample to an enrolled 

template(s), interfaces with the physical or 

logical access control system and indicates 

the response from the system. 

10 Biometric Access Control System Biometric 

System 

A combination of an Enrollment 

Subsystem and a Verification Subsystem 

tested as a combined system. 

34 NIST Handbook 150-25:2009 
A.2.2 Test methods 

A.2.2.1 General

For each scope of accreditation, the test methods are listed below. When a higher scope is elected from 

the chained list of currently offered scopes (see A.2.1.2), all test methods associated with the prerequisite 

scopes also become mandatory. A NVLAP test method code is formed by concatenation of the numeric 

code for Biometrics Testing (“30”), a “/” delimiter, the abbreviation of the scope’s name (e.g., “TISCT” 

for the “Technical Interface Standards Conformance Testing” scope of accreditation), and a sequence 

number (e.g., “01” for first test method). 

NOTE At least one test method must be selected for a given scope of accreditation; however, all test methods 

listed under a scope do not have to be selected. 

A.2.2.2 Biometrics Testing and Analysis (30/BTA) 

The minimum level of required expertise is described as “Biometrics Testing and Analysis (BTA)” and it 

is covered by the 30/BTA scope of accreditation. 30/BTA is not available as a stand-alone scope of 

accreditation. It is mandated as a prerequisite for all other scopes of accreditation, therefore no specific 

test method is associated with it. 

A.2.2.3 Conformance Testing (30/CT) 

A.2.2.3.1 General 

For strictly conformance to standards testing, the minimum required expertise is described as 

“Conformance Testing (30/CT).” This scope of accreditation is mandated as a prerequisite for the 

“Technical Interface Standards Conformance Testing (30/TISCT)” and for the “Data Interchange 

Standards Conformance Testing (30/DISCT)” scopes of accreditation. Because the 30/CT scope of 

accreditation is not offered as a stand-alone scope of accreditation, no test methods are associated with it. 

A.2.2.3.2 Technical Interface Standards Conformance Testing (30/TISCT) 

30/TIST01 Conformance testing for the Biometric Application Programming Interface (BioAPI) – 

national standards 

30/TIST02 Conformance testing for the Biometric Application Programming Interface (BioAPI) – 

international standards 

30/TIST03 Conformance testing for Common Biometric Exchange Formats Framework (CBEFF) 

biometrics information records – national standards 

30/TIST04 Conformance testing for Common Biometric Exchange Formats Framework (CBEFF) 

biometrics information records – international standards 

A.2.2.3.3 Data Interchange Standards Conformance Testing (30/DISCT) 

30/DISCT01 Conformance Testing for the data interchange formats for finger minutia data – national 

standards 

NIST Handbook 150-25:2009 35 
30/DISCT02 Conformance Testing for the data interchange formats for finger minutia data – 

international standards 

30/DISCT03 Conformance Testing for the data interchange formats for finger pattern spectral data – 

national standards 

30/DISCT04 Conformance Testing for the data interchange formats for finger pattern spectral data – 

international standards 

30/DISCT05 Conformance Testing for the data interchange formats for finger image data – national 

standards 

30/DISCT06 Conformance Testing for the data interchange formats for finger image data – 

international standards 

30/DISCT07 Conformance Testing for the data interchange formats for face recognition image data – 

national standards 

30/DISCT08 Conformance Testing for the data interchange formats for face image data – international 

standards 

30/DISCT09 Conformance Testing for the data interchange formats for iris image data – international 

standards 

30/DISCT10 Conformance Testing for the data interchange formats for signature/sign time series data 

– international standards 

30/DISCT11 Conformance Testing for the data interchange formats for finger pattern skeletal data – 

international standards 

30/DISCT12 Conformance Testing for the data interchange formats for vascular image data – 

international standards 

30/DISCT13 Conformance Testing for the data interchange formats for hand geometry silhouette data 

– international standards 

30/DISCT14 Conformance Testing for the data interchange formats for signature/sign processed 

dynamic data – international standards 

30/DISCT15 Conformance Testing for the speech data interchange formats for speaker recognition – 

international standards 

30/DISCT16 Conformance Testing for the data interchange formats for DNA data – international 

standards 

NOTE Test methods 30/DISCT01 through 30/DISCT16 address only testing of the Biometric Data Interchange 

Records (BDIR) requirements as defined in INCITS 423.1, Level 1 and Level 2, and both types: A and B. 

36 NIST Handbook 150-25:2009 
A.2.2.4 Scenario Testing – Human crew (lab) (30/ST) 

A.2.2.4.1 General

The minimum required expertise necessary to perform any type of scenario testing is described as 

“Scenario Testing (30/ST)” and is not available as a stand-alone scope of accreditation. This scope is 

associated with either the “System Level Testing (30/SLT)” or “Biometric Sample Collection Testing 

(30/BSCT)” scope. 

NOTE The goal of scenario testing is to determine the overall system performance in a prototype or simulated 

application. Testing is carried out on a complete system in an environment that models a real-world target 

application of interest. Each tested system will have its own acquisition sensor and so will receive slightly different 

data. Consequently, care will be required that data collection across all tested systems is in the same environment 

with the same population. Test results will be repeatable only to the extent that the modeled scenario can be 

carefully controlled. 

A.2.2.4.2 System Level Testing (30/SLT) 

The minimum expertise required to perform any performance testing for scenario type testing is described 

as “System-Level Testing (30/SLT),” and is not available as a stand-alone scope of accreditation. This 

scope is associated with either the “Conformance to Performance Specifications Testing (30/CPST)”, 

“Graded Performance Testing (30/GPT),” or “Pure Performance Testing (30/PPT)” scope of 

accreditation. 

A.2.2.4.3 Conformance to Performance Specifications Testing (30/CPST) 

30/CPST01 Performance Test Methods for Qualifying to TSA Airport QPL Requirements 

NOTE The test method listed above is one example of testing to performance specification. In this case the test 

method refers to the TSA specifications. 

A.2.2.4.4 Graded Performance Testing (30/GPT) 

30/GPT01 Performance Test Methods for Grading Biometrics System Performance 

A.2.2.4.5 Requirements for other technologies associated with (30/ST)

Specific requirements for the Pure Performance Testing (30/PPT) and Biometric Sample Collection 

Testing (30/BSCT) scopes of accreditation will be developed and published in future editions of this 

handbook. 

A.2.2.5 Interoperability Testing (30/IT) 

Specific requirements for the scopes of accreditation associated with Interoperability Testing (30/IT) will 

be developed and published in future editions of this handbook. 

NIST Handbook 150-25:2009 37 
A.2.2.6 Technology Testing − Non-human/Laboratory (30/TT) 

Specific requirements for the scopes of accreditation associated with Technology Testing − Nonhuman/Laboratory (30/TT) will be developed and published in future editions of this handbook. 

A.2.2.7 Operational Testing (30/OT)

Specific requirements for the scopes of accreditation associated with Operational Testing (30/OT) will be 

developed and published in future editions of this handbook. 

A.2.2.8 Usability Testing (30/UT)

Specific requirements for the scopes of accreditation associated with Usability Testing (30/UT) will be 

developed and published in future editions of this handbook. 

A.2.3 Additional references 

A.2.3.1 Additional references for Biometrics Testing and Analysis (30/BTA)

There are no references for the Biometrics Testing and Analysis (30/BTA) scope of accreditation 

additional to the ones specified in 1.4 of this handbook. 

A.2.3.2 Additional references for Conformance Testing (30/CT) 

There are no references for the Conformance Testing (30/CT) scope of accreditation additional to the 

ones specified in 1.4 of this handbook. 

A.2.3.3 Additional references for Technical Interface Standards Conformance Testing 

(30/TISCT) 

A.2.3.3.1 National standards 

— INCITS 429:2008: Information Technology - Conformance Testing Methodology for ANSI INCITS 

358-2002, BioAPI Specification – draft, http://www.incits.org [This standard specifies the 

methodology and test assertions for testing conformance of Biometric Service Providers (BSPs) to the 

BioAPI Specification.] 

— ANSI INCITS 358-2002: BioAPI Specification, version 1.1, 13 February 2002. 

http://webstore.ansi.org 

— INCITS project 1853-D: Conformance Testing Methodology for Common Biometric Exchange 

Formats Framework (CBEFF) Data Structures Specified in INCITS 398-2008, under development, 

http://www.incits.org 

— ANSI/INCITS 398-2008: Information technology – Common Biometric Exchange Formats 

Framework (CBEFF), http://webstore.ansi.org 

A.2.3.3.2 International standards 

— ISO/IEC 24709-1:2007: Information Technology – BioAPI Conformance Testing - Part 1: Methods 

and Procedures 

38 NIST Handbook 150-25:2009 
— ISO/IEC 24709-2:2007: Information Technology – BioAPI Conformance Testing - Part 2: Test 

Assertions for Biometric Service Providers 

— 1.37.24709.3: Information Technology – BioAPI Conformance Testing - Part 3: Test Assertions for 

BioAPI Frameworks, under development 

— 1.37.24709.4: Information Technology – BioAPI Conformance Testing - Part 4: Test Assertions for 

Biometric Applications, under development 

— ISO/IEC 19784-1:2006: Information Technology – BioAPI - Biometric Application Programming 

Interface – Part 1: BioAPI Specification

— ISO/IEC 19785-1:2006: Information Technology – Common Biometric Exchange Formats 

Framework (CBEFF) – Part 1: Data Element Specification

— ISO/IEC 19785-2:2006: Information Technology – Common Biometric Exchange Formats 

Framework (CBEFF) – Part 2: Procedures for the Operation of the Biometrics Registration 

Authority

— ISO/IEC 19785-3:2007: Information Technology – Common Biometric Exchange Formats 

Framework (CBEFF) – Part 3: Patron Format Specifications 

— 1.37.19785.4: Information Technology – Common Biometric Exchange Formats Framework 

(CBEFF) – Part 4: Security Block Format Specifications, under development 

A.2.3.4 Additional references for Data Interchange Standards Conformance (30/DISC) 

A.2.3.4.1 National standards 

— INCITS 423.1: Information Technology - Conformance Testing Methodology Standard for Biometric 

Data Interchange Format Standards - Part 1: Generalized Conformance Testing Methodology, 

January 2008 

— INCITS 423.2: Information Technology - Conformance Testing Methodology Standard for Biometric 

Data Interchange Format Standards - Part 2: Conformance Testing Methodology for INCITS 378-

2004, Finger Minutiae Format for Data Interchange, July 2007

— ANSI INCITS 378-2004: Information Technology – Finger Minutiae Format for Data Interchange, 

http://webstore.ansi.org 

— INCITS 423.3: Information Technology - Conformance Testing Methodology Standard for Biometric 

Data Interchange Format Standards - Part 3: Conformance Testing Methodology for INCITS 377-

2004, Finger Pattern Data Interchange Format, under development 

— ANSI INCITS 377-2004: Information Technology – Finger Pattern Based Interchange Format, 

http://webstore.ansi.org 

— INCITS 423.4: Information Technology - Conformance Testing Methodology Standard for Biometric 

Data Interchange Format Standards - Part 4: Conformance Testing Methodology for INCITS 381, 

Finger Image Data Interchange Format, under development 

NIST Handbook 150-25:2009 39 
— ANSI INCITS 381-2004: Information Technology – Finger Image Based Interchange Format, 

http://webstore.ansi.org 

— INCITS 423.5: Information Technology - Conformance Testing Methodology Standard for Biometric 

Data Interchange Format Standards - Part 5: Conformance Testing Methodology for INCITS 385, 

Face Recognition Format for Data Interchange, under development 

— ANSI INCITS 385-2004: Information Technology - Face Recognition Format for Data Interchange, 

http://webstore.ansi.org 

A.2.3.4.2 International standards 

— 1.37.29109.1: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 1: Generalized Conformance Testing Methodology, under development 

— 1.37.29109.2: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 2: Finger Minutiae Data, under development 

— ISO/IEC 19794–2:2005: Information Technology - Biometric Data Interchange Formats – Part 2: 

Finger Minutiae Data, http://www.iso.org 

— 1.37.29109.3: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 3: Finger Pattern Spectral Data, under development 

— ISO/IEC 19794–3:2006: Information Technology - Biometric Data Interchange Formats – Part 3: 

Finger Pattern Spectral Data, http://www.iso.org 

— 1.37.29109.4: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 4: Finger Image Data, under development 

— ISO/IEC 19794–4:2005: Information Technology - Biometric Data Interchange Formats – Part 4: 

Finger Image Data, http://www.iso.org 

— 1.37.29109.5: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 5: Face Image Data, under development 

— ISO/IEC 19794–5:2005: Information technology - Biometric Data Interchange Formats – Part 5: 

Face Image Data, http://www.iso.org 

— 1.37.29109.6: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 6: Iris Image Data, under development 

— ISO/IEC 19794–6:2005: Information technology - Biometric Data Interchange Formats – Part 6: Iris 

Image Data, http://www.iso.org 

40 NIST Handbook 150-25:2009 
— 1.37.29109.7: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 7: Signature/Sign Time Series Data, under development 

— ISO/IEC 19794–7:2006: Information Technology - Biometric Data Interchange Formats – Part 7: 

Sign/Signature Behavioral Data, http://www.iso.org 

— 1.37.29109.8: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 8: Finger Pattern Skeletal Data, under development 

— ISO/IEC 19794–8:2006: Information Technology - Biometric Data Interchange Formats – Part 8: 

Finger Pattern Skeletal Data, http://www.iso.org 

— 1.37.29109.9: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 9: Vascular Image Data, under development 

— ISO/IEC 19794–9:2007: Information Technology - Biometric Data Interchange Formats – Part 9: 

Vascular Biometric Image Data, http://www.iso.org 

— 1.37.29109.10: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 10: Hand Geometry Silhouette Data, under development 

— ISO/IEC 19794–10:2005: Information Technology - Biometric Data Interchange Formats – Part 10: 

Hand Geometry Silhouette Data

— 1.37.29109.11: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 11: Signature/Sign Processed Dynamic Data, under development 

— 1.37.19794–11: Information Technology - Biometric Data Interchange Formats – Part 11: 

Signature/Sign Processed Dynamic Data, under development 

— 1.37.29109.13: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 13: Speech Data Interchange Format for Speaker Recognition, under development 

— 1.37.19794–13: Information Technology - Biometric Data Interchange Formats – Part 13: Voice 

Data, under development 

— 1.37.29109.14: Information Technology – Conformance Testing Methodology for Biometric Data 

Interchange Records as defined in ISO/IEC 19794 Biometric Data Interchange Format Standard – 

Part 1: Generalized Conformance Testing Methodology, under development 

— 1.37.19794–14: Information Technology - Biometric Data Interchange Formats – Part 14: DNA 

Data, under development 

NIST Handbook 150-25:2009 41 
A.2.3.5 Additional references for Scenario Testing – Human crew (lab) (30/ST) 

— ANSI INCITS 409.1-2005: Information Technology - Biometric Performance Testing and Reporting 

– Part 1: Principles and Framework, http://webstore.ansi.org 

— ANSI INCITS 409.3-2005: Information Technology - Biometric Performance Testing and Reporting 

– Part 3: Scenario Testing and Reporting, http://webstore.ansi.org 

— ISO/IEC Project 19795-1:2006: Information Technology - Biometric Performance Testing and 

Reporting – Part 1: Principles and Framework, http://www.iso.org 

— ISO/IEC CD 19795-2:2007: Information Technology - Biometric Performance Testing and Reporting 

– Part 2: Testing Methodologies for Technology and Scenario Evaluation, http://www.iso.org 

A.2.3.6 Additional references for System Level Testing (30/SLT) 

There are no references for the System Level Testing (30/SLT) scope of accreditation additional to the 

ones specified in 1.4 of this handbook. 

A.2.3.7 Additional references for Conformance to Performance Specifications Testing 

(30/CPST) 

A.2.3.7.1 National standards 

— Guidance Package: Biometrics for Airport Access Control, 30 September 2005, Transportation 

Security Administration, http://www.tsa.gov/assets/pdf/biometrics_guidance.pdf 

— INCIT Project 1602-5: Information Technology - Biometric Performance Testing and Reporting - 

Part 5: Framework for Testing and Evaluation of Biometric Systems for Access Control, June 2008, 

under development 

A.2.3.7.2 International standards 

— 1.37.19795.5: Information Technology – Biometric Performance Testing and Reporting – Part 5: 

Performance of Biometric Access Control Systems, under development 

A.2.3.8 Additional references for Technology Testing (30/TT) - general 

A.2.3.8.1 National standards 

— ANSI INCITS 409.2-2005: Information Technology - Biometric Performance Testing and Reporting 

– Part 2: Technology Testing and Reporting, http://webstore.ansi.org 

A.2.3.8.2 International standards 

— ISO/IEC Project 19795-1:2006: Information Technology - Biometric Performance Testing and 

Reporting – Part 1: Principles and Framework, http://www.iso.org 

— ISO/IEC 19795-2:2007: Information Technology - Biometric Performance Testing and Reporting – 

Part 2: Testing Methodologies for Technology and Scenario Evaluation, particularly clause 6, 

http://www.iso.org 

42 NIST Handbook 150-25:2009 
A.2.3.9 Additional references for technologies not yet offered for accreditation

Additional references for the following specific scopes of accreditation will be developed and published, 

as needed, in future editions of this handbook: 

• Technology Testing – Non-Human/Laboratory (30/TT) 

o Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

o Sensor Technology Testing (STT) 

o Sensor Image Quality Algorithm Testing (SIQAT) 

o Biometric Image Segmentation Testing (BIST) 

o Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

A.2.4 Additional terms and definitions 

A.2.4.1 

Data Interchange Conformance Testing - Level 1 testing 

Conformance testing methodology that checks in a biometric data structure field by field and byte by byte 

conformance with the specification of the biometric data structure as specified in the base standard, both 

in terms of fields included and the ranges of the values in those fields. This type of testing tests syntactic 

requirements of the base standard. 

A.2.4.2 

Data Interchange Conformance Testing - Level 2 testing 

Conformance testing methodology that tests the internal consistency of a biometric data structure under 

test, relating values from one part or field of the data structure to values from other parts or fields of the 

data structure. This type of testing tests syntactic requirements of the base standard. 

A.3 Additional accreditation process requirements 

A.3.1 General 

Requirements provided in this clause are subject to change at any time. The Biometrics LAP website 

(http://ts.nist.gov/Standards/Accreditation/BIO-LAP.cfm) will provide all requirements that could not be 

documented in this handbook and all updates for the existing requirements. In order for a NVLAP 

laboratory to apply for any Biometrics LAP scope of accreditation, the laboratory shall firstly satisfy the 

Biometric Testing and Analysis (30/BTA) scope of accreditation requirements. 

A.3.2 Additional initial accreditation requirements 

A.3.2.1 Additional initial accreditation requirements for System Level Testing (30/SLT) 

A laboratory applying for 30/SLT scope of accreditation or to any scope of accreditation that requires 

30/SLT as a prerequisite shall owe or rent a physical facility with adequate floor space for the size of the 

required human crew and with adequate physical security commensurable with the collected and/or tested 

data sensitivity and with the hosted equipment. 

NIST Handbook 150-25:2009 43 
A.3.2.2 Additional initial accreditation requirements for Conformance to Performance 

Specifications Testing (30/CPST) 

A laboratory shall have the capability to execute the statistical analysis methodologies identified by 

conformity assessment procurement, to determine the confidence intervals to be used in establishing the 

Pass/Fail recommendation for each specified test metric. 

A.3.2.3 Additional initial accreditation requirements for Graded Performance Testing (30/GPT) 

A.3.2.3.1 A laboratory applying for the 30/GPT scope of accreditation shall have the staff experienced 

or trained in, and possess the tools needed to perform, custom integration of the biometric devices to 

facilitate automated capture of biometric matching similarity scores. This data (while not absolutely 

required) should be collected whenever possible to achieve the maximum benefit of the testing results. 

A.3.2.3.2 A laboratory shall have the capability to execute the statistical analysis methodologies 

specified to determine the confidence intervals to be used in establishing the grading level determination 

for each specified test metric. 

A.3.2.4 Scopes of accreditation with no additional initial accreditation requirements 

There are no initial accreditation requirements additional to those provided in 3.1 of this document for the 

following scopes of accreditation: 

• Biometrics Testing and Analysis (30/BTA) 

• Conformance Testing (30/CT) 

• Technical Interface Standards Conformance Testing (30/TISCT) 

• Data Interchange Standards Conformance Testing (30/DISCT) 

• Scenario Testing – Human Crew (30/ST). 

A.3.2.5 Additional initial accreditation requirements for technologies not yet offered for 

accreditation

Additional initial accreditation requirements for the following specific scopes of accreditation will be 

developed and published, as needed, in future editions of this handbook: 

• Pure Performance Testing (30/PPT) 

• Biometric Sample Collection Testing (30/BSCT) 

• Interoperability Testing (30/IT) 

• Sensor Interoperability Testing (30/SIT) 

• Modality-Specific Template/Matcher Interoperability Testing (30/MTIT) 

• Technology Testing – Non-Human/Laboratory (30/TT) 

• Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

• Sensor Technology Testing (STT) 

• Sensor Image Quality Algorithm Testing (SIQAT) 

• Biometric Image Segmentation Testing (BIST) 

• Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

44 NIST Handbook 150-25:2009 
A.3.3 Additional activities prior to initial on-site assessment 

There are no requirements additional to those provided in 3.2 of this handbook. 

A.3.4 Additional on-site assessment requirements 

There are no requirements additional to those provided in 3.3 of this handbook. 

A.3.5 Additional proficiency testing requirements 

A.3.5.1 Additional proficiency testing requirements for Conformance to Performance 

Specifications Testing (30/CPST) 

A laboratory shall demonstrate their capability and proficiency in performing the specific statistical 

analysis to be applied to the test results to determine confidence intervals for the measured data, and 

subsequently the Pass/Fail decision relative to the Performance Specifications. This proficiency is tested 

by executing the statistical analysis methodology, programmed into the laboratory’s data analysis 

processing system. 

A.3.5.2 Additional proficiency testing requirements for the Graded Performance Testing 

(30/GPT) 

A laboratory shall demonstrate their capability and proficiency in performing the specific statistical 

analysis to be applied to the test results to determine confidence intervals for the measured data, and 

subsequently the grade level determination relative to the grading criteria. This proficiency shall be tested 

by executing the statistical analysis methodology, programmed into the laboratory’s data analysis 

processing system. 

A.3.5.3 Scopes of accreditation with no additional proficiency testing requirements

There are no proficiency testing requirements additional to those provided in 3.4 of this document for the 

following scopes of accreditation: 

• Biometrics Testing and Analysis (30/BTA) 

• Conformance Testing (30/CT) 

• Technical Interface Standards Conformance Testing (30/TISCT) 

• Data Interchange Standards Conformance Testing (30/DISCT) 

• Scenario Testing – Human Crew (30/ST) 

• System Level Testing (30/SLT). 

A.3.5.4 Additional proficiency testing requirements for technologies not yet offered for 

accreditation

Additional proficiency testing requirements for the following specific scopes of accreditation will be 

developed and published, as needed, in future editions of this handbook: 

• Pure Performance Testing (30/PPT) 

• Biometric Sample Collection Testing (30/BSCT) 

• Interoperability Testing (30/IT) 

• Sensor Interoperability Testing (30/SIT) 

NIST Handbook 150-25:2009 45 
• Modality-Specific Template/Matcher Interoperability Testing (30/MTIT) 

• Technology Testing – Non-Human/Laboratory (30/TT) 

• Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

• Sensor Technology Testing (STT) 

• Sensor Image Quality Algorithm Testing (SIQAT) 

• Biometric Image Segmentation Testing (BIST) 

• Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

A.4 Additional management requirements for accreditation 

There are no requirements additional to those provided in clause 4 of this document. 

A.5 Additional technical requirements for accreditation 

A.5.1 Additional personnel requirements 

A.5.1.1 General 

The laboratory‘s key technical personnel (see 5.2.2) shall be trained or have three years of direct work 

experience, prior to accreditation, in the area of biometrics products testing best practice, biometric 

technologies and events relevant to practicing privacy protection, and possess basic knowledge of: 

• biometric matching and template generation algorithms and uses; 

• biometric testing harnesses and implementations; 

• physical security; 

• protection of personally identifiable information; 

• identification and authentication technologies and techniques; 

• conformance requirements. 

A.5.1.2 Additional personnel requirements for Biometrics Testing and Analysis (30/BTA) 

There are no requirements additional to those provided in clause 5.2 of this document. 

A.5.1.3 Additional personnel requirements for Conformance Testing (30/CT) 

The laboratory‘s key technical personnel shall have experience or be trained prior to accreditation in the 

area of: 

• biometrics standards conformance testing listed in this document; 

• knowledge of eXtensible Markup Language (XML); 

• familiarity with the NIST/ITL Reference Implementation (RI); 

• familiarity with the NIST/ITL Conformance Testing Suite (CTS) – installation, test assertions, 

tests execution and test reports; 

• familiarity with the test methodology standards and/or DTRs. 

46 NIST Handbook 150-25:2009 
A.5.1.4 Additional personnel requirements for Technical Interface Standards Conformance 

Testing (30/TISCT) 

A laboratory applying for the 30/TISCT scope of accreditation shall demonstrate competency in installing 

and running the latest version of the Conformance Testing Suite for the biometric technical interface 

provided by NIST/ITL or in any other testing suite indicated by the CAC through NVLAP. 

A.5.1.5 Additional personnel requirements for Data Interchange Standards Conformance Testing 

(30/DISCT 

A laboratory applying for the 30/DISCT scope of accreditation shall demonstrate competency in installing 

and running the latest version of the Conformance Testing Suite for the biometric data interchange 

formats provided by NIST/ITL or in any other testing suite indicated by the CAC through NVLAP. 

A.5.1.6 Additional personnel requirements for Scenario Testing –Human Crew (30/ST) 

The laboratory shall have personnel with experience training, prior to accreditation, in the areas of: 

• biometric device installation, integration and operation; 

• biometric testing detailed product-specific procedures development; 

• test crew management (recruitment, authentication, scheduling, training, anonymity, 

compensation); 

• control of crew demographic distribution; 

• Personal Identifier Information (PII) data protection and management; 

• data review, reduction and analysis. 

A.5.1.7 Additional personnel requirements for System Level Testing (30/SLT) 

There are no requirements additional to those provided in clause 5.2 of this document. 

A.5.1.8 Additional personnel requirements for Conformance to Performance Specifications 

Testing (30/CPST) 

In addition to the requirements set forth by the prerequisite scopes of accreditation, the laboratory 

personnel shall have experience or be trained prior to accreditation in the area of: statistical data analysis 

techniques related to Pass/Fail recommendation. 

A.5.1.9 Additional personnel requirements for Graded Performance Testing (30/GPT) 

In addition to the requirements set forth by the prerequisite scopes of accreditation, the laboratory 

personnel shall have experience or be trained prior to accreditation in the area of statistical data analysis 

techniques related to grade level recommendation. 

A.5.1.10 Additional personnel requirements for technologies not yet offered for accreditation

Additional personnel requirements for the following specific scopes of accreditation will be developed 

and published, as needed, in future editions of this handbook: 

• Pure Performance Testing (30/PPT) 

• Biometric Sample Collection Testing (30/BSCT) 

NIST Handbook 150-25:2009 47 
• Interoperability Testing (30/IT) 

• Sensor Interoperability Testing (30/SIT) 

• Modality-Specific Template/Matcher Interoperability Testing (30/MTIT) 

• Technology Testing – Non-Human/Laboratory (30/TT) 

• Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

• Sensor Technology Testing (STT) 

• Sensor Image Quality Algorithm Testing (SIQAT) 

• Biometric Image Segmentation Testing (BIST) 

• Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

A.5.2 Additional accommodation and environmental conditions 

There are no requirements additional to those provided in clause 5.3 of this document. 

A.5.3 Additional test and calibration methods and method validation 

There are no requirements additional to those provided in clause 5.4 of this document. 

A.5.4 Additional equipment requirements 

A.5.4.1 Additional equipment requirements for System Level Testing (30/SLT) 

The laboratory applying for accreditation for the 30/SLT scope shall also possess the following 

equipment: 

• network components (switches, routers, cables, etc.) to reconfigure computing and network 

resources; 

• hardware components (brackets, shelves, etc) to reconfigure biometric device mounting; 

• dedicated enrollment and verification sub-system (possibly provided by the Conformity 

Assessment Council or the vendors of the system under test). 

A.5.4.2 Scopes of accreditation with no additional equipment requirements 

There are no equipment requirements additional to those provided in 5.5 of this document for the 

following scopes of accreditation: 

• Biometrics Testing and Analysis (30/BTA) 

• Conformance Testing (30/CT) 

• Technical Interface Standards Conformance Testing (30/TISCT) 

• Data Interchange Standards Conformance Testing (30/DISCT) 

• Scenario Testing – Human Crew (30/ST) 

• Conformance to Performance Specifications Testing (30/CPST) 

• Graded Performance Testing (30/GPT). 

48 NIST Handbook 150-25:2009 
A.5.4.3 Additional equipment requirements for technologies not yet offered for accreditation

Additional equipment requirements for the following specific scopes of accreditation will be developed 

and published, as needed, in future editions of this handbook: 

• Pure Performance Testing (30/PPT) 

• Biometric Sample Collection Testing (30/BSCT) 

• Interoperability Testing (30/IT) 

• Sensor Interoperability Testing (30/SIT) 

• Modality-Specific Template/Matcher Interoperability Testing (30/MTIT) 

• Technology Testing – Non-Human/Laboratory (30/TT) 

• Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

• Sensor Technology Testing (STT) 

• Sensor Image Quality Algorithm Testing (SIQAT) 

• Biometric Image Segmentation Testing (BIST) 

• Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

A.5.5 Additional measurement traceability 

A.5.5.1 Scopes of accreditation with no additional measurement traceability requirements 

There are no measurement traceability requirements additional to those provided in 5.6 of this document 

for the following scopes of accreditation: 

• Biometrics Testing and Analysis (30/BTA) 

• Conformance Testing (30/CT) 

• Technical Interface Standards Conformance Testing (30/TISCT) 

• Data Interchange Standards Conformance Testing (30/DISCT) 

• Scenario Testing – Human Crew (30/ST) 

• System Level Testing (30/SLT) 

• Conformance to Performance Specifications Testing (30/CPST) 

• Graded Performance Testing (30/GPT). 

A.5.5.2 Additional measurement traceability requirements for technologies not yet offered for 

accreditation

Additional measurement traceability requirements for the following specific scopes of accreditation will 

be developed and published, as needed, in future editions of this handbook: 

• Pure Performance Testing (30/PPT) 

• Biometric Sample Collection Testing (30/BSCT) 

• Interoperability Testing (30/IT) 

• Sensor Interoperability Testing (30/SIT) 

• Modality-Specific Template/Matcher Interoperability Testing (30/MTIT) 

• Technology Testing – Non-Human/Laboratory (30/TT) 

• Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

• Sensor Technology Testing (STT) 

NIST Handbook 150-25:2009 49 
• Sensor Image Quality Algorithm Testing (SIQAT) 

• Biometric Image Segmentation Testing (BIST) 

• Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

A.5.6 Additional sampling requirements 

A.5.6.1 Scopes of accreditation with no additional sampling requirements 

There are no sampling requirements additional to those provided in 5.7 of this document for the following 

scopes of accreditation: 

• Biometrics Testing and Analysis (30/BTA) 

• Conformance Testing (30/CT) 

• Technical Interface Standards Conformance Testing (30/TISCT) 

• Data Interchange Standards Conformance Testing (30/DISCT) 

• Scenario Testing – Human Crew (30/ST) 

• System Level Testing (30/SLT) 

• Conformance to Performance Specifications Testing (30/CPST) 

• Graded Performance Testing (30/GPT). 

A.5.6.2 Additional sampling requirements for technologies not yet offered for accreditation

Additional sampling requirements for the following specific scopes of accreditation will be developed and 

published, as needed, in future editions of this handbook: 

• Pure Performance Testing (30/PPT) 

• Biometric Sample Collection Testing (30/BSCT) 

• Interoperability Testing (30/IT) 

• Sensor Interoperability Testing (30/SIT) 

• Modality-Specific Template/Matcher Interoperability Testing (30/MTIT) 

• Technology Testing – Non-Human/Laboratory (30/TT) 

• Modality-Specific Matcher Algorithm Performance Testing (MMAPT) 

• Sensor Technology Testing (STT) 

• Sensor Image Quality Algorithm Testing (SIQAT) 

• Biometric Image Segmentation Testing (BIST) 

• Data Compression Software Testing (DCST) 

• Operational Testing (OT) 

• Usability Testing (UT). 

50 NIST Handbook 150-25:2009 
NIST Handbook 150-25:2009 51 

Annex B 

(informative) 

Acronyms and abbreviations 

B.1 The following acronyms and abbreviations are found throughout this handbook: 

ANSI: American National Standards Institute 

BSP: Biometric Service Providers 

CAC: Conformity Assessment Council 

DTR: Derived Test Requirements 

EAR: Federal Export Administration Regulations 

FIPS: Federal Information Processing Standard 

IG: Implementation Guidance 

INCITS: InterNational Committee for Information Technology Standards 

IRB: Institutional Review Board 

ISO: International Organization for Standardization 

ITL: Information Technology Laboratory 

LAP: Laboratory Accreditation Program 

NIST: National Institute of Standards and Technology 

PII: Personally Identifiable Information 

QPL: Qualified Product List 

SUT: System Under Test 

TSA: Transportation Security Administration 

B.2. The acronyms associated with the various Biometrics Testing scopes of accreditation are 

defined in the legend that accompanies Figure A.3 in Annex A.