ISO/IEC 19989-1:2020 PDF

Overview - ISO/IEC 19989-1:2020 (Framework)

ISO/IEC 19989-1:2020 defines a general framework for the security evaluation of biometric systems. It specifies extended security functional components and supplementary evaluation activities to be used when assessing:

• biometric recognition performance (verification and identification), and
• presentation attack detection (PAD) for biometric systems.

This part (Part 1: Framework) introduces the evaluation structure, vulnerability categorization, and the additional evaluator guidance. Detailed recommendations for biometric recognition and PAD evaluation are provided in companion documents ISO/IEC 19989-2 and ISO/IEC 19989-3.

Key technical topics and requirements

• Extended Security Functional Components - Adds biometric-specific components to Common Criteria SFR classes (notably Class FPT: protection of the TSF, and Class FIA: identification and authentication). Examples in the standard include FPT_PAD, FPT_BCP, FIA_EBR, FIA_BVR, and FIA_BID (see standard for full definitions and component levelling).
• Supplementary Activities to ISO/IEC 18045 - Provides additional evaluation activities and guidance for methodology classes (e.g., APE, ASE, ADV, AGD, ALC, ATE, AVA) to address biometric-specific concerns.
• Vulnerability Categorization - Describes common biometric system vulnerabilities, categorization of Targets of Evaluation (TOEs), and how those relate to recognition and PAD evaluation.
• Evaluation Scope - Applicable to TOEs implementing a single biometric characteristic type (selection from multiple characteristics in SFRs is allowed).
• Guidance for Evaluators - Recommends extra evaluator activities, audit items, and management considerations (e.g., capture quality checks, failure-to-enrol/performance requirements, PAD management and audit).

Practical applications

• Use ISO/IEC 19989-1 when planning or performing security evaluations of biometric verification and identification systems to ensure:
  • Consistent, repeatable evaluation against Common Criteria SFRs augmented for biometric functions.
  • PAD assessment is incorporated into security testing and lifecycle activities.
  • Vulnerability analysis and attack potential specific to biometric modalities are considered.

Practical settings:

• Certification laboratories and Common Criteria evaluation teams
• Biometric product vendors and developers preparing security targets
• Procurement teams specifying evaluation criteria for biometric systems
• System integrators and risk managers validating biometric component security

Who should use this standard

• Evaluators and test laboratories performing Common Criteria evaluations of biometric TOEs
• Product developers creating biometric systems seeking evaluated assurance levels
• Certification bodies and auditors that need consistent biometric evaluation frameworks
• Procurement and security architects specifying biometric security requirements

Related standards and keywords

• Related: ISO/IEC 15408 (Common Criteria), ISO/IEC 18045 (evaluation methodology), ISO/IEC 19989-2, ISO/IEC 19989-3
• Keywords: biometric security, biometric evaluation, presentation attack detection (PAD), security functional requirements (SFR), Common Criteria, TOE evaluation, biometric recognition performance.