Wither 

Certification? 

C. Tilton 

7 March 2012 

 
Conformance 

Meeting the requirements of a standard or specification 

Functional & Non-functional 

Performance 

Accuracy 

Throughput, response time, capacity 

Daon Proprietary and Confidential 2 
Elements 

3 

Conformance Performance 

Certification 
Levels of Conformance Testing 

4 

• Path 1: IT Product 

Developer self declaration

Validated 

Products 

Lists/ 

Certificates 

Validation/ 

Certification 

 Bodies 

Accredited 

Testing Labs 

Laboratory 

Accreditation 

Bodies 

IT Product 

Developers consumers 

1 

2 2 

3 

3 

3 

4 

User 

Testing Lab 

4 4 

4 

of conformity 

• Path 2: Second Party 

Testing 

• Path 3: Conformance 

demonstrated by 

evaluation in accredited 

laboratory 

• Path 4: Conformance 

demonstrated by 

evaluation and 

validation/certification 

One standard, one test report, accepted everywhere 

Source: NIST & BAH 
Per the FBI: 

Certification provides assurance to users of biometric 

collection systems that certified products meet or exceed 

minimum FBI interoperability standards and will work with 

the Integrated Automated Fingerprint Information System 

(IAFIS). 

These standards ensure that the images used in the 

system are high quality and support all phases of 

identification for both fingerprint experts and the IAFIS. 

Why Certify? 

Daon Proprietary and Confidential 5 
Existing Programs 

FBI – Appendix F and PIV 

BSI 3121 (App F equivalent) 

Airport Access Control QPL 

TWIC Reader QPL/QTL 

UID STQC 

FIPS 201 Approved Products List 

MINEX certified template generators/matchers 

Common Criteria certification 

DoD EBTS certification 

ILO SID certification 

NVLAP Biometrics Laboratory Accreditation Program 

6 
FBI Certification Categories 

7 
History ...

 WASHINGTON--(BUSINESS WIRE)--April 27, 1998--

 ICSA-The Security Assurance Company 

 The International Computer Security Association (ICSA, formerly NCSA) 

Monday announced the industry's first six biometric product certifications at a 

press conference held in Washington, D.C. 

 The certification announcement follows six weeks of rigorous testing by the 

ICSA Biometrics Certification Lab. 

"We have arrived at an exciting juncture in the history of the biometrics industry," 

said Dr. Peter Tippett, ICSA president. "As evidenced by the high quality 

products which achieved certification today, biometrics technology has arrived 

and is no longer only the stuff of fictional James Bond movies. 

 "ICSA certification will help advance the deployment of biometrics by 

providing customers a framework for continuous and measurable product 

improvement." 

8 
Accuracy Rqts 

Daon Proprietary and Confidential 9 

• Verification: FMR<=10-4 (mand)<=10-5 (rec)

• FNMR <= 10 X9.84 -2 

• FAR: 1 in 106 FIPS 140-2 • Biometric used to protect key 

• SP800-76: EER <= 1% PIV/TWIC • TWIC Reader Spec: EER <= 1% 

• 3 levels of FAR: 0.1%, 0.3%, 1.0% 19795-5 • 6 levels of FRR: 0.33% - 7.00% 
PROs 

• Establishes a baseline 

• Provides confidence for adopters

• Users can leverage a 3rd party 

testing (rather than each doing their 

own) 

• Levels the playing field 

• Can cover a range of requirements 

• Can be domain specific 

CONs 

• Cost (esp. to smaller organizations) 

• One size fits all 

• Multiple certifications – which one(s)? 

• Hesitancy to include performance 

requirements (application specific) 

• Correlation to performance in the 

field is not guaranteed 

• ‘If we have it, they will come’ 

syndrome 

• Technology refresh time (can be) < 

certification time 

Pros & Cons 

of Certification Testing 

Daon Proprietary and Confidential 10
Questions 

Does certification increase or decrease competition? 

Does certification increase adoption of biometric 

technology/products? 

Is the cost/benefit compelling? (To buyers? Vendors?) 

Can today’s rapid timelines support it?

Daon Proprietary and Confidential 11