It should be an assigned/signed device with biometric and passcode access configured... At least it was in a couple proposals I helped define for credentialing emergency responders... though the contract definitely went with a different supplier than the one I was working with.