Biometric Authentication
What is Biometric Authentication?
The use of unique biological characteristics such as fingerprints, facial recognition, iris scans, or voice patterns to verify the identity of a user. Considered a strong form of authentication.
Terms that appear alongside biometric authentication
Each of these is named in at least one of the same controls as biometric authentication. The number is how many controls name both.
- authentication 15 shared controls
- audit 7 shared controls
- gdpr 6 shared controls
- data subject 6 shared controls
- consent 6 shared controls
- biometric data 6 shared controls
- profiling 4 shared controls
- multi factor authentication 4 shared controls
Frameworks that govern biometric authentication
What the standards actually require on biometric authentication
Requirements naming biometric authentication across 6 standards, quoted from the control text.
For biometric-based authentication, employ mechanisms that satisfy the following biometric quality requirements [Assignment: organization-defined biometric quality requirements].
NIST800-IA-5(12) · IA-5(12) Authenticator Management | Biometric Authentication Performance →Article 12 of the Kazakhstan PDPL establishes the data localization requirement for biometric personal data of Kazakhstan citizens and residents - a key sovereignty provision strengthened by the 2022 amendment.
KZ-PDPL-Biometric-Data-Localization-Article12-Server-Kazakhstan-On-Soil-Data-Storage-Citizens-Residents · Kazakhstan PDPL Biometric Data Localization + Article 12 + Mandatory Server Storage in Kazakhstan + 2022 Amendment + Citizens + Residents + Foreign Cloud Provider Restrictions + Data Sovereignty + State Service for Information Security Oversight →Non-biometric devices (badge, code) are preferred where they give sufficient security. Biometric authentication is possible only as a subsidiary measure, where the employer demonstrates that alternative devices or organisational and technical measures cannot r...
cnil-guidance-on-employee-monitoring-and-workplace-video-surveillance::ACC-8 · ACC-8 Use biometric access control only as a subsidiary measure, justified, with the template held on an individual medium →Information need: whether an access control system exists, how far it reaches and how good it is. Measure: the strength of the physical entry control system on a 0 to 5 scale: 0 no access control system; 1 PIN code entry (one factor);
iso-iec-27004-2016::B.19 · Physical entry controls system evaluation →Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication confirms that each party to a communication (for example a person, device, service or application) really is who it claims to be, and gives assurance that no party is impersonating anothe...
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →Section 4(4)(a) of Kentucky CDPA establishes the heightened consent requirement for sensitive data processing. (1) Section 2 Sensitive Data Definition - 8 Categories: (a) Racial or ethnic origin; (b) Religious beliefs; (c) Mental or physical health diagnosis;
KY-CDPA-Sensitive-Data-Affirmative-Consent-Race-Religious-Health-Genetic-Biometric-Children-Citizenship · Kentucky CDPA Sensitive Data + Affirmative Consent + Race/Ethnicity + Religious + Mental/Physical Health + Sexual Orientation + Citizenship/Immigration + Genetic + Biometric + Children's Data + Precise Geolocation (1,750 ft) + Section 4 Heightened Consent Standard →Questions people ask about biometric authentication
What is Biometric Authentication?
Why is Biometric Authentication important for compliance?
Which compliance frameworks address Biometric Authentication?
Where can I learn more about Biometric Authentication?
See how Biometric Authentication applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.