E8-28376. Announcement of the Establishment of a Laboratory Accreditation Program (LAP) for Laboratories Performing Interoperability, Performance, and Conformance Biometrics Testing Under the National Voluntary Laboratory Accreditation Program and ...

AGENCY:

National Institute of Standards and Technology, Commerce.

ACTION:

Notice.

SUMMARY:

Under the National Voluntary Laboratory Accreditation Program (NVLAP) the National Institute of Standards and Technology (NIST) announces the establishment of a laboratory accreditation program and the availability of applications for accreditation of laboratories that perform biometric testing including interoperability, performance, and conformance testing using internationally recognized standards developed by the American National Standards Institute (ANSI), NIST, and by the International Committee for Information Technology Standards (INCITS). Additional standards may be identified throughout the development of the accreditation program technical requirements.

ADDRESSES:

Laboratories may obtain NIST Handbook 150, NVLAP Procedures and General Requirements, NIST Handbook 150-25, Biometrics, and an application for this program by calling [phone], by writing to NVLAP Biometrics Testing Manager, National Voluntary Laboratory Accreditation Program, 100 Bureau Drive/MS 2140, Gaithersburg, MD 20899-2140, or by sending e-mail to [e-mail]. All applications for accreditation must be submitted to: NVLAP/Accounts, National Institute of Standards and Technology, Building 101, Room A800, 100 Bureau Drive/MS 1624, Gaithersburg, MD 20899-1624.

FOR FURTHER INFORMATION CONTACT:

Brad Moore, Program Manager, NIST/NVLAP, 100 Bureau Drive, Stop 2140, Gaithersburg, MD 20899-2140, Phone: [phone] or e-mail: [e-mail].

Information regarding National Voluntary Laboratory Accreditation Program (NVLAP) and the accreditation process can be obtained from http://www.nist.gov/​nvlap.

SUPPLEMENTARY INFORMATION:

Background: In 2007, the United States Department of Homeland Security (DHS) requested that NIST establish a laboratory accreditation program for laboratories performing interoperability, performance, and conformance biometrics testing on Personal Identification Verification equipment used in Homeland Security Applications. According to guidance developed by DHS, laboratory accreditation by NVLAP is a recommended step in assuring reliability and quality practices as part of a conformance test program for biometric access control devices.^[1]

Biometric technologies such as facial, fingerprint, iris, and voice recognitions are used to verify the identity of individuals attempting to gain access to secure areas. The purpose of the proposed Biometrics Laboratory Accreditation Program is to evaluate testing laboratories' technical competencies against known standards and testing criteria that will ultimately be used to provide confidence in the performance of biometric sub-systems.

In accordance with NVLAP procedures (15 CFR Part 285), on February 29, 2008, NIST published a notice in the Federal Register requesting comments on the proposed establishment of a laboratory accreditation program for laboratories performing testing, interoperability, performance, and conformance biometrics testing under the National Voluntary Laboratory Accreditation Program (73 FR 11093). The comment period closed on March 31, 2008. Five responses to this request for comments were received and are summarized below. NVLAP held a public workshop on July 1, 2008 to solicit further comments on the establishment of a Biometrics Testing LAP and on the technical requirements to be associated with the LAP. A transcript of the workshop question and answer session is available on request from NVLAP, National Institute of Standards and Technology, 100 Bureau Drive, Mail Stop 2140, Gaithersburg, Maryland 20899-2140; phone [phone]; fax [phone]; e-mail: [e-mail].

Summary of Comments

Four of five comments received supported NIST's establishment of an accreditation program to recognize the competence of biometrics testing laboratories in support of DHS. Two responses were from testing laboratories (one non-profit and one for-profit) that provide standards-based performance testing of biometrics technologies. One response was from a state department of justice. One response was from a provider (vendor) of biometric identity management systems, applications and services. The fifth response, from a non-profit accreditation body, stated that there was no need for a government program since there were four nationally and internationally recognized U.S. private sector laboratory accreditation bodies capable of offering this type of accreditation.

Determination

DHS requirements are intended to set a level field for vendors seeking to demonstrate that their equipment meets federal, state and local procurement and grant guidance requirements. These requirements stipulate that vendor equipment must undergo type testing by a third party laboratory that has been accredited by a recognized laboratory accreditation body to specific requirements for laboratories conducting biometric performance testing. These specific requirements include the required minimum performance standard for the enrollment, matching and transaction time metrics for biometric subsystems. Requirements for airport access control systems are further documented in the 2005 TSA Guidance Package. DHS requirements also stipulate the need to ensure consistency across laboratories that perform biometrics subsystem testing. The current estimate of the number of laboratories that are likely to seek accreditation under this program is between three and five.

There are no recognized laboratory accreditation bodies in the private sector that currently meet DHS requirements. Of the five nationally and internationally recognized private sector bodies currently in operation, only one offers accreditation in the general Information Technology field of testing, and none offer accreditation to the DHS-stipulated specific program requirements for biometrics testing.

In addition, the expertise to competently run specific biometrics tests called out by DHS has not been widely demonstrated in the private sector and tests have not been conducted extensively on commercial equipment to date. Test method execution and test result consistency and comparability are critical issues in biometrics testing based on the new applications of biometrics for identity management in homeland security. NIST technical staff are leading and participating in the development of many of these test methods A laboratory accreditation organization with published accreditation requirements for biometrics testing laboratories, an active proficiency testing program for all participating laboratories, and access to technical experts in the testing methodology associated with new applications of biometrics for identity management in homeland security is needed to support this DHS program. There is no existing private sector program that meets these requirements.

Based on careful analysis of comments received both during the public comment period and in the public workshop, and a detailed review of DHS requirements, the Chief of NVLAP has determined that the establishment of a LAP for laboratories performing inoperability, performance, and conformance biometrics testing on Personal Identification Verification equipment used in Homeland Security Applications best meets government needs.

This notice is issued in accordance with NVLAP procedures and general requirements, found in Title 15 Part 25 of the Code of Federal Regulations.

NVLAP provides an unbiased, third-party evaluation and recognition of competence. NVLAP accreditation signifies that a laboratory has demonstrated that it operates in accordance with NVLAP management and technical requirements pertaining to quality systems, personnel, accommodation and environment, test and calibration methods, equipment, measurement traceability, sampling, handling of test and calibration items, and test and calibration reports.

NVLAP accreditation does not imply any guarantee (certification) of laboratory performance or test/calibration data. NVLAP accreditation is a finding of laboratory competence.

Technical Requirements for the Accreditation Process: NVLAP assessments are conducted in accordance with the National Voluntary Laboratory Accreditation Program regulations, which are found at 15 CFR part 285. NVLAP accreditation is in full conformance with relevant standards of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), including ISO/IEC 17025.

Accreditation is granted to a laboratory following successful completion of a process, which includes submission of an application and payment of fees by the laboratory, a review of the laboratory management system documentation, an on-site assessment by technical experts, participation in proficiency testing, and resolution of any management system or technical nonconformities identified during any phase of the application process. The accreditation is formalized through issuance of a Certification of Accreditation and Scope of Accreditation.

General requirements for accreditation are given in NIST Handbook 150, NVLAP Procedures and General Requirements. The specific technical and administrative requirements for the program for accreditation of laboratories that test biometrics are given the draft NIST Handbook 150-25, Biometrics. Laboratories must meet all NVLAP criteria and requirements in order to become accredited. To be considered for accreditation, the applicant laboratory must provide a completed application to NVLAP, pay all required fees, agree to conditions for accreditation, and must be competent to perform the tests prescribed in the standard.

Application Requirements: (1) Legal name and full address of the laboratory; (2) Ownership of the laboratory; (3) Authorization Representative's name and contact information; (4) Names, titles, and contact information for laboratory staff nominated to serve as Approved Signatories of test and calibration reports that reference NVLAP accreditation; (5) Organization chart defining relationships that are relevant to performing testing and calibrations covered in the accreditation request; (6) General description of laboratory, including its facilities and scope of operations; and (7) Requested scope and accreditation.

For this program, the laboratory shall provide a copy of its management system documents, including quality manual and related documentation, where appropriate, prior to the on-site assessment. NVLAP will review the management system documentation and discuss any nonconformities with the Authorized Representative before the on-site visit. Laboratories that apply for accreditation will be required to pay NVLAP fees and undergo on-site assessment and shall meet proficiency testing requirements before initial accreditation can be granted.

Paperwork Reduction Act: This action contains a collection of information requirement subject to review and approval by the Office of Management and Budget (OMB) under the Paperwork Reduction Act (PRA) of 1995. Collection activities for NVLAP are currently approved by OMB under control number 0693-0003.

Notwithstanding any other provisions of the law, no person is required to respond to, nor shall any person be subject to a penalty for failure to comply with a collection of information unless it displays a currently valid OMB Control Number.

Dated: November 20, 2008.

Patrick Gallagher,

Deputy Director.

Footnotes

1.  Guidance Package on Biometrics for Airport Access Control released in October 2005, Volume 1: Requirements Document, Chapter 2 Operational System Requirements.