Compliance is the floor. Independent testing tells you where you stand above it.
International standards such as ISO/IEC 30107 and ISO/IEC 19989 provide the framework for evaluating Presentation Attack Detection (PAD) performance. Understanding what these standards require, and equally, what they do and do not demonstrate, is essential for interpreting evaluation results and making informed decisions about biometric security.
The foundation of credible testing
Ingenium is an ISO/IEC 17025 accredited laboratory, the internationally recognised standard for the technical competence and quality management of testing organisations. This accreditation is not self-declared. It is assessed and certified by an independent accreditation body operating under the International Laboratory Accreditation Cooperation (ILAC) framework, with certification provided by Perry Johnson Laboratory Accreditation, Inc.
For PAD evaluation specifically, Ingenium is accredited against:
ISO/IEC 30107: the internationally recognised standard for biometric presentation attack detection, defining the methodology, terminology, and performance metrics used in PAD evaluation.
Ingenium is a FIDO Alliance Accredited Laboratory, authorised to evaluate biometric components under the BCC or IDV-Face certification programme and document authentication solutions under the Document Authentication certification programme. We are also a MOSIP-accredited test laboratory and the designated laboratory for the UK National Protective Security Authority (NPSA) for the evaluation of biometric access control systems. These accreditations reflect our expertise in independent biometric testing and our commitment to internationally recognised evaluation standards.
Accreditation is not a proxy for good testing. It is a prerequisite. What it confirms is that Ingenium’s methodology is transparent, repeatable, and subject to independent review.
What the frameworks say, and what they govern
ISO/IEC 30107: Biometric presentation attack detection
ISO/IEC 30107 is the primary standard for PAD testing. It establishes the conceptual and technical framework for how presentation attacks are defined, how attack instruments are classified, and how the performance of a PAD subsystem is measured and reported.
The standard defines the two core evaluation metrics: Attack Presentation Classification Error Rate (APCER) and Bona Fide Presentation Classification Error Rate (BPCER). Every Ingenium PAD evaluation is structured in accordance with ISO/IEC 30107. It is the reference point against which methodology, reporting, and results are validated.
ISO/IEC I9989: Criteria and methodology for security evaluation of biometric systems
ISO/IEC 19989 bridges traditional biometric standards, including ISO/IEC 30107 and ISO/IEC 19795, with the Common Criteria security evaluation framework defined in ISO/IEC 15408 and ISO/IEC 18045. Where ISO/IEC 30107 defines how to evaluate a PAD capability, ISO/IEC 19989 defines how PAD fits into a formal security evaluation of an entire biometric system.
ISO/IEC 19989-3 is a Common Criteria-based test methodology, following the principles set out in ISO/IEC 15408. It provides a specific IT security evaluation of biometric technology, combining functional and vulnerability testing to produce an evaluation outcome for a conformance assessment body. For PAD evaluation, this means results are structured to support formal security certification processes as well as independent assurance.
NIST SOFA-B: Strength of function for authenticators: biometrics
The NIST SOFA-B framework provides a consistent basis for classifying the sophistication of presentation attack species. It describes the level of expertise, resource, and prior knowledge required to produce and execute a given attack type. Ingenium uses SOFA-B to characterise attack species across the three levels (A, B, and C) that structure its PAD evaluation tiers.
FIDO Alliance
Ingenium is an authorised FIDO test laboratory, providing evaluation services aligned to FIDO biometric component and remote identity verification certification programmes. For vendors and organisations operating in markets where FIDO certification is a requirement or commercial consideration, this provides a directly applicable path to independent validation.
The difference between a baseline and a benchmark
Meeting the requirements of a standard is a meaningful achievement. It confirms that a system has been evaluated in line with best practice, at a defined point in time, using a clear methodology.
What it may not confirm is how that system performs against the full range of attack types being used today, across all the platforms and devices it is deployed on, or at the attack level that organised threat actors are currently capable of. Standards can be written in advance of the threat landscape they seek to evaluate. The most consequential vulnerabilities are often found in the space between what a standard mandates and what attackers have since developed.
This is not an argument against compliance. It is an argument for going beyond the baseline to provide organisations with clarity on their risk exposure. Organisations and vendors that treat a compliance evaluation as the ceiling of their assurance posture may carry residual risk that the standard was not designed to surface.
Independent testing, informed by a broader and more current threat model, provides the additional layer of assurance that standards-based evaluation alone may not always deliver.
Structured tiers. Current threats. Reproducible results.
Ingenium evaluates PAD performance through a structured five-tier framework, designed in accordance with ISO/IEC 30107 principles, with attacks characterised using the NIST SOFA-B framework. Each tier provides a progressively more demanding assessment, from baseline assurance through to comprehensive evaluation against high-sophistication attack species.
This structure gives clients a clear path from a baseline compliance evaluation to deeper independent assurance, within a consistent and reproducible methodology.
Where regulatory requirements, procurement criteria, or risk profiles call for it, Ingenium can also develop bespoke evaluations of threat-specific attack species, targeted platform testing, or scenario-led assessment aligned to a client’s particular deployment context.
In both cases, results are reported in a format that is transparent, reproducible, and usable, whether internally, with clients, regulators, or in support of a procurement process.
Third-party validation that goes beyond self-evaluation
For technology vendors, standards alignment is a commercial consideration as much as a technical one. Buyers, regulators, and procurement teams increasingly distinguish between vendor claims and independently verified performance. Accredited, standards-aligned evaluation provides the foundation that internal evaluations cannot.
Ingenium’s ISO/IEC 17025 accreditation and alignment to ISO/IEC 30107, ISO/IEC 19989, and the FIDO certification programme means that evaluation results are independently credible and directly usable in procurement, regulatory, and market-facing contexts. Published results can be referenced with confidence, because the methodology behind them is transparent and the laboratory producing them is externally accredited.
Independent validation is not a compliance requirement in every market. But it is increasingly the standard that informed buyers expect.
The question isn't whether you comply. It's whether you're protected.
Whether you are preparing for regulatory scrutiny, building independent validation into your product offering, or assessing where your systems stand against current standards, Ingenium provides the impartial evidence and reporting to give you a clear picture.