BIOMETRIC INFORMATION MANAGEMENT AND SECURITY FOR THE FINANCIAL SERVICES INDUSTRY

Superseded date

06-25-2024

Published date

02-14-2017

Publisher

American Bankers Association

1 Scope
2 Conformance
3 Normative References
4 Terms and Definitions
5 Symbols and Abbreviated Terms
6 Biometric Technology Overview
7 Basic Principles of Biometric Architectures
8 Management and Security Requirements
9 Techniques
Annex A (normative) - Biometric Information Schema
Annex B (Normative) - Security Requirements for Biometric
Devices
Annex C (Normative) - Event Journal
Annex D (Normative) - Biometric Matching Decision Control
Annex E (Normative) - Biometric Event Information Management
Annex F (Normative) - Biometric Validation Control Objectives
Annex G (Normative) - ISO 8583 Messages
Annex H (Informative) - Data Flow Diagrams
Annex I (Informative) - Biometric Enrollment
Annex J (Informative) - Security Considerations
Annex K (Informative) - Public Acceptance and Policy
Considerations
Annex L (Informative) - Comparison of Other Biometric Standards
Annex M (Informative) - Business Cases
Bibliography

Defines the security framework for using biometrics for authentication of individuals in financial services.

Committee	X9
DocumentType	Standard
PublisherName	American Bankers Association
Status	Superseded
SupersededBy	ANSI X9.84:2018

ANSI X9.96 : 2004	FINANCIAL SERVICES - XML CRYPTOGRAPHIC MESSAGE SYNTAX (XCMS)
INCITS/ISO/IEC 7816-11 : 2004	IDENTIFICATION CARDS - INTEGRATED CIRCUIT CARDS - PART 11: PERSONAL VERFICATION THROUGH BIOMETRIC METHODS
ANSI X9.117 : 2012	SECURE REMOTE ACCESS - MUTUAL AUTHENTICATION
CSA ISO/IEC 7816-11 : 2005 : R2010	IDENTIFICATION CARDS - INTEGRATED CIRCUIT CARDS - PART 11: PERSONAL VERIFICATION THROUGH BIOMETRIC METHODS
04/30107739 DC : DRAFT MARCH 2004	ISO/IEC 19794-6 - BIOMETRIC DATA INTERCHANGE - PART 6 - IRIS IMAGE DATA
ANSI INCITS 379 : 2004	INFORMATION TECHNOLOGY - IRIS IMAGE INTERCHANGE FORMAT
BS ISO/IEC 19794-8 : 2011	INFORMATION TECHNOLOGY - BIOMETRIC DATA INTERCHANGE FORMATS - PART 8: FINGER PATTERN SKELETAL DATA
ANSI X9.112-1 : 2009	WIRELESS MANAGEMENT AND SECURITY - PART 1: GENERAL REQUIREMENTS
ISO/IEC 19794-8:2011	Information technology — Biometric data interchange formats — Part 8: Finger pattern skeletal data
ANSI X9.112 : 2016	WIRELESS MANAGEMENT AND SECURITY - PART 1: GENERAL REQUIREMENTS
ISO/TR 13569:2005	Financial services Information security guidelines
CSA ISO/IEC 7816-11:2005	IDENTIFICATION CARDS - INTEGRATED CIRCUIT CARDS - PART 11: PERSONAL VERIFICATION THROUGH BIOMETRIC METHODS
ANSI X9.104-1 : 2004(R2017)	FINANCIAL SERVICES - FINANCIAL TRANSACTION CARD ORIGINATED MESSAGES - CARD ACCEPTOR TO ACQUIRING HOST MESSAGES - PART 1: MESSAGES, DATA ELEMENTS AND CODE VALUES
PD ISO/TR 13569:2005	Financial services. Information security guidelines
ANSI X9.108 : DRAFT 2005	FINANCIAL TRANSACTION MESSAGES - ELECTRONIC BENEFITS TRANSFER (EBT) - WIC RETAILER INTERFACE STANDARD
ANSI INCITS 394 : 2004	INFORMATION TECHNOLOGY - APPLICATION PROFILE FOR INTEROPERABILITY, DATA INTERCHANGE AND DATA INTEGRITY OF BIOMETRIC-BASED PERSONAL IDENTIFICATION FOR BORDER MANAGEMENT
CSA ISO/IEC 7816-11 : 2005 : R2015	IDENTIFICATION CARDS - INTEGRATED CIRCUIT CARDS - PART 11: PERSONAL VERIFICATION THROUGH BIOMETRIC METHODS
ANSI X9.79-1 : 2001	FINANCIAL SERVICES PUBLIC KEY INFRASTRUCTURE - PART 1: PKI PRACTICES AND POLICY FRAMEWORK

ANSI X9.30.1 : 1997	PUBLIC KEY CRYPTOGRAPHY FOR THE FINANCIAL SERVICES INDUSTRY - PART 1: THE DIGITAL SIGNATURE ALGORITHM (DSA)
ISO 15782-1:2009	Certificate management for financial services Part 1: Public key certificates
ISO/IEC 18033-1:2015	Information technology Security techniques Encryption algorithms Part 1: General
ISO/IEC 19785-1:2015	Information technology Common Biometric Exchange Formats Framework Part 1: Data element specification
ISO/IEC 7816-6:2016	Identification cards — Integrated circuit cards — Part 6: Interindustry data elements for interchange
ISO/IEC 27001:2013	Information technology — Security techniques — Information security management systems — Requirements
ISO/IEC 8825-2:2015	Information technology ASN.1 encoding rules: Specification of Packed Encoding Rules (PER) Part 2:
ISO/IEC 8825-1:2015	Information technology ASN.1 encoding rules: Specification of Basic Encoding Rules (BER), Canonical Encoding Rules (CER) and Distinguished Encoding Rules (DER) Part 1:
ISO 11568-2:2012	Financial services — Key management (retail) — Part 2: Symmetric ciphers, their key management and life cycle
ANSI X9.52 : 1998	TRIPLE DATA ENCRYPTION ALGORITHM MODES OF OPERATION
FIPS PUB 140-2 : 0	SECURITY REQUIREMENTS FOR CRYPTOGRAPHIC MODULES
ANSI X9.24-1 : 2017	RETAIL FINANCIAL SERVICES - SYMMETRIC KEY MANAGEMENT - PART 1: USING SYMMETRIC TECHNIQUES
ISO/IEC 9834-8:2014	Information technology Procedures for the operation of object identifier registration authorities Part 8: Generation of universally unique identifiers (UUIDs) and their use in object identifiers
ISO/IEC 15816:2002	Information technology — Security techniques — Security information objects for access control
ANSI X9.69 : 2017	FRAMEWORK FOR KEY MANAGEMENT EXTENSIONS
ISO 11568-1:2005	Banking — Key management (retail) — Part 1: Principles
ANSI X9.44:2007	FINANCIAL SERVICES - PUBLIC-KEY CRYPTOGRAPHY FOR THE FINANCIAL SERVICES INDUSTRY - KEY ESTABLISHMENT USING INTEGER FACTORIZATION CRYPTOGRAPHY
ISO 8583-1:2003	Financial transaction card originated messages — Interchange message specifications — Part 1: Messages, data elements and code values
ISO/IEC 9594-2:2017	Information technology Open Systems Interconnection The Directory Part 2: Models
ISO 11568-4:2007	Banking — Key management (retail) — Part 4: Asymmetric cryptosystems — Key management and life cycle
ANSI X9.63 : 2011	FINANCIAL SERVICES - PUBLIC KEY CRYPTOGRAPHY FOR THE FINANCIAL SERVICES INDUSTRY, KEY AGREEMENT AND KEY TRANSPORT USING ELLIPTIC CURVE CRYPTOGRAPHY
ANSI X9.30.2 : 1997	PUBLIC KEY CRYPTOGRAPHY USING IRREVERSIBLE ALGORITHMS - PART 2: THE SECURE HASH ALGORITHM (SHA-1)
ISO/IEC 24761:2009	Information technology Security techniques Authentication context for biometrics
ISO/IEC 19784-1:2006	Information technology Biometric application programming interface Part 1: BioAPI specification
ANSI X9.42 : 2003(R2013)	PUBLIC KEY CRYPTOGRAPHY FOR THE FINANCIAL SERVICES: AGREEMENT OF SYMMETRIC KEYS USING DISCRETE LOGARITHM CRYPTOGRAPHY
ANSI X9.31 : 1998	DIGITAL SIGNATURES USING REVERSIBLE PUBLIC KEY CRYPTOGRAPHY FOR THE FINANCIAL SERVICES INDUSTRY (RDSA)
ANSI X9.73 : 2017	CRYPTOGRAPHIC MESSAGE SYNTAX - ASN.1 AND XML