A fallback process is the alternate path used when the primary identity control fails or cannot be applied. For biometric systems, it defines how exceptions are handled, who can override the decision, and what evidence is retained for review.
What a fallback process does
A fallback process is the alternate path an organisation uses when the primary control cannot complete its job. In identity systems, that usually means deciding how to handle exceptions safely, who may approve them, and what evidence must be preserved so the bypass is reviewable rather than invisible.
Why fallback exists in security controls
Fallback is not a convenience layer, it is part of the control design. Real systems fail, users are locked out, devices go offline, biometrics can be unavailable, and policy decisions sometimes need a supervised exception path. A sound fallback process keeps the organisation operating without quietly turning a strong control into an unmanaged override.
Because fallback changes the effective security posture, it must be defined alongside the primary control, not added ad hoc after a failure. If the alternate path is vague, operators tend to improvise, which creates inconsistent decisions, weak accountability, and gaps in audit evidence.
Fallback in biometric and identity workflows
Biometric systems make the fallback question especially important because an exception often means the system is allowing access another way. That can include manual review, alternate authenticators, supervisory approval, or a temporary step-up process. The key issue is not just whether the user gets through, but whether the organisation can explain why the exception was granted and whether the same exception would be granted again under the same conditions.
Good fallback design also separates temporary exception handling from long-term policy. If too many users rely on fallback, the exception path becomes the real path, and the primary control stops being authoritative.
Evidence, accountability, and control integrity
The most important property of a fallback process is traceability. The process should leave enough evidence to reconstruct the decision later, including who approved it, what condition triggered it, and whether the primary control was unavailable, failed, or was deliberately bypassed. NIST SP 800-53 Rev 5 Security and Privacy Controls is a useful reference for the broader control logic around access, authentication, auditability, and configuration discipline that fallback procedures rely on.
Fallback should also preserve the integrity of the original control. If the alternate path can be invoked too easily, reused without scrutiny, or granted without recorded justification, the organisation effectively creates a hidden access path. That is why fallback design is inseparable from review, logging, and periodic testing of the exception process.
Risk and Threat Considerations
Fallback processes create risk when they are easier to use than the primary control, poorly monitored, or available to too many operators. In practice, attackers and insiders both benefit from exception paths that are loosely governed, because they can become a quieter route around normal enforcement.
Failure mechanism: A weak fallback path can be used to override authentication or access decisions without strong justification, allowing the exception to become the easiest path through the control.
Impact: The result can be unauthorized access, weak auditability, and loss of confidence in the primary control, especially when fallback use is frequent or poorly reviewed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Fallback processes depend on controlled exception handling for authentication and evidence retention. |
| AU-6 — Audit Review, Analysis, and Reporting | Fallback decisions need audit records so overrides can be reviewed after use. | |
| AC-2 — Account Management | Fallback can affect account access decisions and must align with account governance and approval. | |
| Recommendation — Define and govern alternate authentication handling so exceptions stay reviewable and time-bound. Review fallback events in audit logs and investigate repeated or unapproved override patterns. Align fallback approvals with account governance so alternate access remains authorised and traceable. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Fallback is part of access-control design when exceptions alter how access is granted. |
| A.8.15 — Logging | Fallback processes require logs that preserve who approved or used the exception path. | |
| Recommendation — Document and enforce fallback access rules so exception paths remain controlled. Log fallback activations and approvals so exception use can be reviewed and investigated. | ||
Practitioner Guidance
Governance implication: Treat fallback as a controlled security decision, not an operational afterthought. Define who may authorize it, what evidence must be retained, and when the exception must expire or be escalated for review.
What to watch for: Repeated fallback use, vague approval records, or fallback paths that differ by team or location are signs that the exception process is drifting into a parallel control.
Practitioner takeaway: A well-designed fallback process should keep the organisation available without making the security control optional.
Related resources from NHI Mgmt Group
- What is the difference between an exemption strategy and a fallback process for abandoned authentication?
- What breaks when staff rely on a binary age check without a fallback process?
- Why do NHI programmes need stronger process ownership than many human identity programmes?
- How should organisations govern API partner onboarding as a non-human identity process?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org