Codes & Standards - Purchase
ISO 19092:2023
Financial services — Biometrics — Security framework
SKU: iso_078308_184357
Published by ISO
Publication Year 2023
2 Edition
65 pages
Product Details
This document specifies the security framework for using biometrics for authentication of customers in financial services, focusing exclusively on retail payments. It introduces the most common types of biometric technologies and addresses issues concerning their application. This document also describes representative architectures for the implementation of biometric authentication and associated minimum control objectives.
The following are within the scope of this document:
— use of biometrics for the purpose of:
— verification of a claimed identity;
— identification of an individual;
— biometric authentication threats, vulnerabilities and controls;
— validation of credentials presented at enrolment to support authentication;
— management of biometric information across its life cycle, comprising enrolment, transmission and storage, verification, identification and termination processes;
— security requirements for hardware used in conjunction with biometric capture and biometric data processing;
— biometric authentication architectures and associated security requirements.
The following are not within the scope of this document:
— detailed specifications for data collection, feature extraction and comparison of biometric data and the biometric decision-making process;
— use of biometric technology for non-financial transaction applications, such as physical or logical system access control.
The following are within the scope of this document:
— use of biometrics for the purpose of:
— verification of a claimed identity;
— identification of an individual;
— biometric authentication threats, vulnerabilities and controls;
— validation of credentials presented at enrolment to support authentication;
— management of biometric information across its life cycle, comprising enrolment, transmission and storage, verification, identification and termination processes;
— security requirements for hardware used in conjunction with biometric capture and biometric data processing;
— biometric authentication architectures and associated security requirements.
The following are not within the scope of this document:
— detailed specifications for data collection, feature extraction and comparison of biometric data and the biometric decision-making process;
— use of biometric technology for non-financial transaction applications, such as physical or logical system access control.
