Standards and compliance
Understanding biometric and identity compliance standards for injection attack detection
Biometric and identity standards and compliance frameworks provide an essential foundation for identity system security. Understanding what they require, what they cover, and where independent testing adds value is critical to making well-informed decisions about your systems and your assurance programme.
What the frameworks say and what they're designed to do
Several internationally recognised standards govern the testing and evaluation of biometric and identity systems, and injection attack detection in particular. The most relevant are:
CEN/TS 18099
Injection Attack Detection The primary European standard for injection attack detection testing. It defines evaluation levels (Substantial and High) with specific requirements for the number and type of Injection Attack Methods (IAMs) and Injection Attack Instruments (IAIs) to be tested against. CEN/TS 18099 forms the foundation of Ingenium’s Level 1 and Level 2 test programmes.
ISO/IEC 30107
Presentation Attack Detection The international standard for PAD testing. While focused on presentation attacks, it provides relevant methodology for testing biometric system resilience and is directly relevant to any system with both PAD and IAD exposure.
ISO/IEC 19795
Biometric Performance Testing The internationally recognised framework for evaluating biometric system performance, covering accuracy, reliability, and demographic equity. Ingenium is accredited to test against this standard.
NIST SP 800-63-4
Digital Identity Guidelines US federal guidance on digital identity assurance, increasingly referenced in international contexts. It provides a risk-based framework for evaluating identity system strength and has direct implications for organisations operating in or seeking access to US federal markets.
FIDO Alliance
Ingenium is an authorised test laboratory for FIDO biometric and remote identity verification certification programmes. FIDO certification provides a recognised baseline of component-level assurance for biometric and identity systems.
The value of meeting a standard
Compliance with a recognised standard is meaningful. It confirms that a system has been evaluated against a defined set of requirements, by a process that meets criteria for methodological validity. It provides a common reference point for procurement decisions, regulatory submissions, and market positioning.
Ingenium conducts compliance-level testing. We support organisations in achieving accreditation under the relevant frameworks and in producing the structured reporting required for regulatory conversations, certification applications, and audit processes.
For vendors, compliance certification is a legitimate differentiator, and achieving it through an ISO/IEC 17025 accredited, independent laboratory adds further credibility to the result.
Standards describe a baseline. They do not describe today's threat.
Compliance with a standard confirms a system met a defined threshold at a point in time. Standards are written to reflect known threats and established testing methodologies. By design, they cannot fully account for threats that emerge after the standard was drafted or for attack methods that exceed what the standard requires testing against.
Regulatory compliance may not be sufficient on its own. The most consequential attacks exploit the gap between what standards mandate and what threat actors are currently capable of.
This is not a reason to deprioritise compliance. It is a reason to understand it accurately and to treat it as a floor, not a ceiling.
Built on standards. Designed to exceed them.
Ingenium’s testing programme is structured around recognised standards and calibrated to go beyond them.
Our Level 1 test aligns with CEN/TS 18099 Substantial. Level 2 aligns with CEN/TS 18099 High. Levels 3 through 5 exceed the standard, incorporating a greater number and diversity of IAMs and IAIs, and drawing on threat intelligence developed through our partnerships with public sector bodies, academic institutions, and international standards working groups.
The result is a programme that satisfies compliance requirements at every applicable level, while providing organisations with the option to test further against the conditions that matter most to their risk profile.
The accreditations that underpin our work
ISO/IEC 17025
Certified independent test laboratory for performance, equity, and security testing
ISO/IEC 19795
Biometric performance testing
ISO/IEC 30107
Presentation attack detection
CEN/TS 18099:2025
Injection attack detection testing to meet CEN and ETSI requirements
FIDO Alliance
Authorised test laboratory for biometric and remote identity verification certification
MOSIP
Trusted testing partner for open-source identity systems
Global ACI framework
Global Accreditation Cooperation Incorporated framework – Accreditation certified by Perry Johnson Laboratory Accreditation, Inc.
The question isn't whether to test. It's how thoroughly.
Whether your goal is regulatory compliance, a stronger assurance position, or both, Ingenium provides the testing, reporting, and expertise to get you there.