[Federal Register Volume 73, Number 230 (Friday, November 28, 2008)]
[Notices]
[Pages 72451-72453]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E8-28376]


-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

National Institute of Standards and Technology

[Docket No.: 080122071-81377-02]


Announcement of the Establishment of a Laboratory Accreditation 
Program (LAP) for Laboratories Performing Interoperability, 
Performance, and Conformance Biometrics Testing Under the National 
Voluntary Laboratory Accreditation Program and Technical Requirements 
for Such a LAP

AGENCY: National Institute of Standards and Technology, Commerce.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: Under the National Voluntary Laboratory Accreditation Program 
(NVLAP) the National Institute of Standards and Technology (NIST) 
announces the establishment of a laboratory accreditation program and 
the availability of applications for accreditation of laboratories that 
perform biometric testing including interoperability, performance, and 
conformance testing using internationally recognized standards 
developed by the American National Standards Institute (ANSI), NIST, 
and by the International Committee for Information Technology Standards 
(INCITS). Additional standards may be identified throughout the 
development of the accreditation program technical requirements.

ADDRESSES: Laboratories may obtain NIST Handbook 150, NVLAP Procedures 
and General Requirements, NIST Handbook 150-25, Biometrics, and an 
application for this program by calling (301) 975-4016, by writing to 
NVLAP Biometrics Testing Manager, National Voluntary Laboratory 
Accreditation Program, 100 Bureau Drive/MS 2140, Gaithersburg, MD 
20899-2140, or by sending e-mail to [email protected]. All applications 
for accreditation must be submitted to: NVLAP/Accounts, National 
Institute of Standards and Technology, Building 101, Room A800, 100 
Bureau Drive/MS 1624, Gaithersburg, MD 20899-1624.

FOR FURTHER INFORMATION CONTACT: Brad Moore, Program Manager, NIST/
NVLAP, 100 Bureau Drive, Stop 2140, Gaithersburg, MD 20899-2140, Phone: 
(301) 975-5740 or e-mail: [email protected].
    Information regarding National Voluntary Laboratory Accreditation 
Program (NVLAP) and the accreditation process can be obtained from 
http://www.nist.gov/nvlap.

SUPPLEMENTARY INFORMATION:
    Background: In 2007, the United States Department of Homeland 
Security (DHS) requested that NIST establish a laboratory accreditation 
program for laboratories performing interoperability, performance, and 
conformance biometrics testing on Personal Identification Verification 
equipment used in Homeland Security Applications. According to guidance 
developed by DHS, laboratory accreditation by NVLAP is a recommended 
step in assuring reliability and quality practices as part of a 
conformance test program for biometric access control devices.\1\
---------------------------------------------------------------------------

    \1\ Guidance Package on Biometrics for Airport Access Control 
released in October 2005, Volume 1: Requirements Document, Chapter 2 
Operational System Requirements.
---------------------------------------------------------------------------

    Biometric technologies such as facial, fingerprint, iris, and voice 
recognitions are used to verify the identity of individuals attempting 
to gain access to secure areas. The purpose of the proposed Biometrics 
Laboratory Accreditation Program is to evaluate testing laboratories' 
technical competencies against known standards and testing criteria 
that will ultimately be used to provide confidence in the performance 
of biometric sub-systems.
    In accordance with NVLAP procedures (15 CFR Part 285), on February 
29, 2008, NIST published a notice in the Federal Register requesting 
comments on the proposed establishment of a laboratory accreditation 
program for laboratories

[[Page 72452]]

performing testing, interoperability, performance, and conformance 
biometrics testing under the National Voluntary Laboratory 
Accreditation Program (73 FR 11093). The comment period closed on March 
31, 2008. Five responses to this request for comments were received and 
are summarized below. NVLAP held a public workshop on July 1, 2008 to 
solicit further comments on the establishment of a Biometrics Testing 
LAP and on the technical requirements to be associated with the LAP. A 
transcript of the workshop question and answer session is available on 
request from NVLAP, National Institute of Standards and Technology, 100 
Bureau Drive, Mail Stop 2140, Gaithersburg, Maryland 20899-2140; phone 
301-975-4016; fax 301-926-2884; e-mail: [email protected].

Summary of Comments

    Four of five comments received supported NIST's establishment of an 
accreditation program to recognize the competence of biometrics testing 
laboratories in support of DHS. Two responses were from testing 
laboratories (one non-profit and one for-profit) that provide 
standards-based performance testing of biometrics technologies. One 
response was from a state department of justice. One response was from 
a provider (vendor) of biometric identity management systems, 
applications and services. The fifth response, from a non-profit 
accreditation body, stated that there was no need for a government 
program since there were four nationally and internationally recognized 
U.S. private sector laboratory accreditation bodies capable of offering 
this type of accreditation.

Determination

    DHS requirements are intended to set a level field for vendors 
seeking to demonstrate that their equipment meets federal, state and 
local procurement and grant guidance requirements. These requirements 
stipulate that vendor equipment must undergo type testing by a third 
party laboratory that has been accredited by a recognized laboratory 
accreditation body to specific requirements for laboratories conducting 
biometric performance testing. These specific requirements include the 
required minimum performance standard for the enrollment, matching and 
transaction time metrics for biometric subsystems. Requirements for 
airport access control systems are further documented in the 2005 TSA 
Guidance Package. DHS requirements also stipulate the need to ensure 
consistency across laboratories that perform biometrics subsystem 
testing. The current estimate of the number of laboratories that are 
likely to seek accreditation under this program is between three and 
five.
    There are no recognized laboratory accreditation bodies in the 
private sector that currently meet DHS requirements. Of the five 
nationally and internationally recognized private sector bodies 
currently in operation, only one offers accreditation in the general 
Information Technology field of testing, and none offer accreditation 
to the DHS-stipulated specific program requirements for biometrics 
testing.
    In addition, the expertise to competently run specific biometrics 
tests called out by DHS has not been widely demonstrated in the private 
sector and tests have not been conducted extensively on commercial 
equipment to date. Test method execution and test result consistency 
and comparability are critical issues in biometrics testing based on 
the new applications of biometrics for identity management in homeland 
security. NIST technical staff are leading and participating in the 
development of many of these test methods A laboratory accreditation 
organization with published accreditation requirements for biometrics 
testing laboratories, an active proficiency testing program for all 
participating laboratories, and access to technical experts in the 
testing methodology associated with new applications of biometrics for 
identity management in homeland security is needed to support this DHS 
program. There is no existing private sector program that meets these 
requirements.
    Based on careful analysis of comments received both during the 
public comment period and in the public workshop, and a detailed review 
of DHS requirements, the Chief of NVLAP has determined that the 
establishment of a LAP for laboratories performing inoperability, 
performance, and conformance biometrics testing on Personal 
Identification Verification equipment used in Homeland Security 
Applications best meets government needs.
    This notice is issued in accordance with NVLAP procedures and 
general requirements, found in Title 15 Part 25 of the Code of Federal 
Regulations.
    NVLAP provides an unbiased, third-party evaluation and recognition 
of competence. NVLAP accreditation signifies that a laboratory has 
demonstrated that it operates in accordance with NVLAP management and 
technical requirements pertaining to quality systems, personnel, 
accommodation and environment, test and calibration methods, equipment, 
measurement traceability, sampling, handling of test and calibration 
items, and test and calibration reports.
    NVLAP accreditation does not imply any guarantee (certification) of 
laboratory performance or test/calibration data. NVLAP accreditation is 
a finding of laboratory competence.
    Technical Requirements for the Accreditation Process: NVLAP 
assessments are conducted in accordance with the National Voluntary 
Laboratory Accreditation Program regulations, which are found at 15 CFR 
part 285. NVLAP accreditation is in full conformance with relevant 
standards of the International Organization for Standardization (ISO) 
and the International Electrotechnical Commission (IEC), including ISO/
IEC 17025.
    Accreditation is granted to a laboratory following successful 
completion of a process, which includes submission of an application 
and payment of fees by the laboratory, a review of the laboratory 
management system documentation, an on-site assessment by technical 
experts, participation in proficiency testing, and resolution of any 
management system or technical nonconformities identified during any 
phase of the application process. The accreditation is formalized 
through issuance of a Certification of Accreditation and Scope of 
Accreditation.
    General requirements for accreditation are given in NIST Handbook 
150, NVLAP Procedures and General Requirements. The specific technical 
and administrative requirements for the program for accreditation of 
laboratories that test biometrics are given the draft NIST Handbook 
150-25, Biometrics. Laboratories must meet all NVLAP criteria and 
requirements in order to become accredited. To be considered for 
accreditation, the applicant laboratory must provide a completed 
application to NVLAP, pay all required fees, agree to conditions for 
accreditation, and must be competent to perform the tests prescribed in 
the standard.
    Application Requirements: (1) Legal name and full address of the 
laboratory; (2) Ownership of the laboratory; (3) Authorization 
Representative's name and contact information; (4) Names, titles, and 
contact information for laboratory staff nominated to serve as Approved 
Signatories of test and calibration reports that reference NVLAP 
accreditation; (5) Organization chart defining relationships that are 
relevant to performing testing and calibrations covered in the 
accreditation request; (6) General description of

[[Page 72453]]

laboratory, including its facilities and scope of operations; and (7) 
Requested scope and accreditation.
    For this program, the laboratory shall provide a copy of its 
management system documents, including quality manual and related 
documentation, where appropriate, prior to the on-site assessment. 
NVLAP will review the management system documentation and discuss any 
nonconformities with the Authorized Representative before the on-site 
visit. Laboratories that apply for accreditation will be required to 
pay NVLAP fees and undergo on-site assessment and shall meet 
proficiency testing requirements before initial accreditation can be 
granted.
    Paperwork Reduction Act: This action contains a collection of 
information requirement subject to review and approval by the Office of 
Management and Budget (OMB) under the Paperwork Reduction Act (PRA) of 
1995. Collection activities for NVLAP are currently approved by OMB 
under control number 0693-0003.
    Notwithstanding any other provisions of the law, no person is 
required to respond to, nor shall any person be subject to a penalty 
for failure to comply with a collection of information unless it 
displays a currently valid OMB Control Number.

    Dated: November 20, 2008.
Patrick Gallagher,
Deputy Director.
[FR Doc. E8-28376 Filed 11-26-08; 8:45 am]
BILLING CODE 3510-13-P