BS ISO/IEC 19795-5:2011

Information technology — Biometric performance testing and reporting Part 5: Access control scenario and grading scheme

This part of ISO/IEC 19795 is concerned with the scientific “technical performance testing” of biometric systems and subsystems to be used for access control.

Technical performance testing seeks to determine error rates and transaction times with the goal of understanding and predicting the real-world error and transaction times of a biometric system.

The error rates include false accept rate, and false reject rate, as well as failure to enrol (FTE) and failure to acquire (FTA) rates across the test population.

These measures are generally applicable to all access control systems that contain a biometric verification subsystem.

This part of ISO/IEC 19795 was conceived to be a framework for a general- or multi-purpose test: “one size fits many (but not all)”:

• The framework is suitable as both a requirements statement and an evaluation report 
• The general-purpose nature of this part of ISO/IEC 19795 is centred on the common access control application requirements, and acknowledges the fact that this framework will not be suitable forspecialized applications (very high levels of protection, specialized user populations like the elderly,

  students, etc.)

The perceived benefit of the general- or multi-purpose test is economy; the supplier can submit to one testing process, and many potential customers can utilize the results, interpreting the suitability of the device (based on the results) for their application.

This testing framework assigns grades representing the tested level of performance, and these grades include a statistical confidence taking the conservative approach, that is, the performance of the system is at least as good as the grade indicated (at the 90% confidence level). Using the grading scheme to specify a required performance level of a system needs to take into account this conservative approach.

It is acknowledged that technical performance testing is only one form of biometric testing. Other types of testing not considered in this part of ISO/IEC 19795 include the following:

• reliability, availability and maintainability
• security, including vulnerability
• human factors, including user acceptance
• environmental
• safety
• cost/benefit
• privacy
• regulation
• compliance

The purpose of this part of ISO/IEC 19795 is to capture the current understanding by the biometrics

community of requirements and best scientific practices for conducting performance testing towards the end of providing consistent, structured evaluations of biometric systems intended for use in access control applications.

The framework defined in this part of ISO/IEC 19795 has utility as a method for defining user

requirements, for specifying the extent of performance evaluation, for conducting and for reporting.