The employer is responsible for the accuracy of biometric data even with a vendor system; it should think carefully about accuracy and suitability for the people captured, must consider whether the biometric type fits the use, should monitor performance and complaints, and must assess and mitigate bias, since facial recognition can be less precise for some demographic groups. Where access depends on solely automated identification, it must provide manual review of denials and let workers ask for review, should restore access quickly (an intercom to a supervisor, for example) and should not disadvantage those who ask for manual review.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.