Guide
Biometric Evidence Standard (BES-1)
A jurisdiction-agnostic evidence architecture standard for producing reviewable, exportable biometric governance records. Clavira is a reference implementation.
What BES-1 Is
BES-1 is a structural evidence architecture standard designed to help organizations produce reviewable, exportable records of biometric governance events. It is jurisdiction-agnostic and product-adjacent — it defines what a defensible evidence artifact should contain, not which vendor or system produces it.
The standard addresses the gap between operational biometric systems (scanners, IAM platforms, workforce systems) and the reviewable record that counsel, auditors, and regulators ask for during inquiries.
- •Defines event attestation structure and required metadata fields
- •Specifies ledger anchoring requirements for tamper-evidence
- •Establishes proof bundle composition for export
- •Describes SIEM reconciliation integration points
Core Evidence Primitives
BES-1 organizes biometric governance evidence around four primitives. Each maps to a distinct phase of the biometric lifecycle and produces a discrete, exportable artifact.
- •Event Attestation — captures purpose, consent reference, policy version, and timestamp at each biometric interaction
- •Anchor to Ledger — writes a tamper-evident checkpoint to an append-only log to preserve sequence integrity
- •Proof Bundle — compiles attestations, anchors, and policy snapshots into a reviewable export package
- •SIEM Reconciliation — streams signed events to security infrastructure for correlation and alerting
Scope Boundaries
BES-1 is not a legal compliance certification, a substitute for legal counsel, or a framework adopted by any regulatory authority. It does not store biometric identifiers and makes no identity decisions.
Organizations implementing BES-1 should validate applicability to their jurisdiction and program with qualified counsel. The standard is designed to support demonstrability — not to serve as a compliance guarantee.
Implementation Guidance
BES-1 is designed to operate as a sidecar layer alongside existing biometric vendors, IAM systems, and systems of record. Implementation does not require replacing capture infrastructure.
The Regulatory Crosswalk document maps each BES-1 component to the evidence expectations of specific frameworks including BIPA, Colorado HB 24-1130, HIPAA, and FFIEC guidance. Download it below for a structured mapping.
Representative Use Cases
Illustrative examples based on real compliance workflows and customer conversations.
Financial Institution (Representative)
In a representative program, adopted BES-1 as the evidence architecture standard across card, branch, and IVR biometrics. Used the regulatory crosswalk to prioritize BIPA and FFIEC controls.
Healthcare Network (Representative)
Implemented BES-1 proof bundles for PHI-adjacent biometric workflows in a representative multi-facility program, enabling consistent exports during HIPAA audit preparation.
Download the Regulatory Crosswalk
Maps BES-1 evidence components to BIPA, Colorado HB 24-1130, HIPAA, FFIEC, and other regulatory frameworks.
Download Crosswalk (v1.0)Evaluate BES-1 for your program
We provide architecture reviews that map your current biometric infrastructure to BES-1 components and identify evidence gaps.