FIDO Regulatory Compliance & Legal Framework 2

Question 1

Under GDPR, how must FIDO authenticators handle biometric data collected during registration?

Accepted Answer

Treat it as special category data requiring explicit consent

Answer

GDPR Article 9 classifies biometric data as special category data requiring explicit consent and heightened protection.

Question 2

Which US federal law most directly governs the use of electronic signatures and FIDO-based authentication in federal agency transactions?

Accepted Answer

ESIGN Act

Answer

The Electronic Signatures in Global and National Commerce (ESIGN) Act establishes legal recognition of electronic signatures and authentication methods in US federal transactions.

Question 3

A FIDO2 deployment at a healthcare provider must comply with HIPAA. Which FIDO characteristic directly supports the HIPAA requirement for unique user identification?

Accepted Answer

Per-user, per-RP credential binding

Answer

FIDO2's per-user, per-relying-party credential binding ensures each user has a cryptographically unique identity, satisfying HIPAA's unique user identification requirement.

Question 4

NIST SP 800-63B classifies FIDO2 hardware security keys as which Authenticator Assurance Level?

Accepted Answer

AAL3

Answer

NIST SP 800-63B places hardware FIDO2 keys with verifier impersonation resistance at AAL3, the highest assurance level.

Question 5

The EU's eIDAS regulation defines 'qualified electronic signatures.' How do most FIDO authenticators relate to this framework?

Accepted Answer

FIDO authenticators typically meet advanced but not qualified electronic signature requirements

Answer

FIDO authenticators generally satisfy advanced electronic signature (AdES) requirements but qualified electronic signatures (QES) require additional certification under eIDAS.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Regulatory Compliance & Legal Framework 2