---
title: "ASM Requirements and Recommendations"
slug: "s3suite94-asm-requirements-and-recommendations"
updated: 2026-10-27T18:42:04Z
published: 2026-10-27T18:42:04Z
canonical: "docs.onespan.com/s3suite94-asm-requirements-and-recommendations"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.onespan.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ASM Requirements and Recommendations

## Requirements for an ASM

A customer-facing FIDO UAF ASM must operate properly and have the right level of security, as defined by the following requirements.

### Operational Requirements

A FIDO UAF ASM must meet the following operational criteria:

- Less than 1 in 20 false negatives on first attempt
- Less than 1 in 2000 two false negatives in a row
- Less than 1 in 10K three false negatives in a row
- Less than three false negatives for 1 in 10K users
- % of false positives is less than 0.01%, so unauthorized access is almost impossible
- The sample size for the above tests is large enough (> 10,000 tries)

> False negative means “Failing to authenticate even with valid credentials”. False positive means “Successful authentication with invalid credentials”.

### Integration Requirements

An authenticator implementation must use the API interfaces defined in the Nok Nok Authenticator SDK.

### Security Requirements

- For software-based authenticators:
  - Use security libraries provided by Nok Nok Labs
  - Use approved methods of protecting authentication template data:
    - Data is encrypted with operating system service, if available, such as CryptoAPI
    - Data is encrypted with a NIST-recommended encryption algorithm with an obfuscated key
- For hardware-based authenticators:
  - Anti-hammering in hardware
  - Approved methods of protecting keys:
    - Stored in hardware (required)
    - Protected by hardware (if possible)
    - Uses elliptic curve (if possible), otherwise uses RSA
  - Approved methods of protecting authentication template data:
    - Stored in hardware (required)
    - Protected by hardware (if possible)