Biometrics
Biometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password. Cyber Essentials accepts biometrics for unlocking devices (A5.9, A5.10) and lists them as passwordless authentication. Like a password or PIN, a biometric unlock must be protected against brute-force attempts.
- Term
- Biometrics
- Also known as
- Biometric authentication, Fingerprint unlock, Face recognition, Face ID, Windows Hello
- Category
- Accounts and access
- Requirement area
- 2. Secure Configuration; 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term biometrics mean in Cyber Essentials?
Biometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password.
Biometric authentication: Uses biological traits of the user such as fingerprints or facial features to confirm their identity
How does biometrics apply to Cyber Essentials?
In plain terms
Unlocking your phone with your thumb, or your laptop by looking at the camera, is biometrics. Common examples are Face ID and Touch ID on Apple devices, Windows Hello on Windows laptops and fingerprint unlock on Android phones. Behind every biometric there is usually a PIN or password you can use instead.
What Cyber Essentials asks
The device unlocking rules in the secure configuration section say that where a device needs someone physically present, "a credential such as a biometric, password or PIN must be in place before a user can gain access to the services." The chosen method must be protected against brute-force attacks by throttling to no more than 10 guesses in 5 minutes or locking after no more than 10 unsuccessful attempts. If the vendor does not let you change this, the vendor's default setting is accepted.
A5.9 asks whether devices you hold in your hand have a locking mechanism, and A5.10 asks which unlock method you use. Biometrics is a valid answer.
The user access control section also lists biometric authentication as a form of passwordless authentication, in the wording quoted above.
What an assessor looks for
The PIN or password behind the biometric. If it only unlocks the device, the minimum is 6 characters. If the same credential is also used to sign in to organisational services, the full password rules apply. A fingerprint reader backed by a 4-digit PIN does not meet the 6-character minimum.
See the device locking and unlocking rules and A5.10. Related: device unlocking, passwordless authentication, passkey.
Related terms
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
- Conditional accessConditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
Frequently asked questions
Biometrics means using a part of your body, such as a fingerprint or your face, to prove who you are instead of typing a password. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, biometrics comes up at A5.9, A5.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Biometrics relates to 2. Secure Configuration; 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.