NIST SP 800-63
The US National Institute of Standards and Technology Digital Identity Guidelines. Defines Identity Assurance Levels (IAL), Authenticator Assurance Levels (AAL), and Federation Assurance Levels (FAL). The reference framework for federal and many enterprise identity programs.
The value of SP 800-63 is that it separates three questions people constantly conflate: how well we proved who you are (IAL), how strongly you authenticated (AAL), and how much we trust an assertion from another party (FAL). Writing requirements against those levels rather than against products is what makes a control survive a vendor migration, and it is why US federal and many regulated programs reference it directly.
See also: IAL, AAL, FAL, phishing-resistant MFA, identity verification
Related on Start with Identity
- GlossaryWebAuthn
A W3C standard browser API for public-key authentication. WebAuthn is the protocol used by passkeys and FIDO2 security keys. The relying party server stores the
- GlossaryIdentity Proofing
Identity proofing is the process of confirming that an applicant is a specific, real person before issuing them an account or credential; [NIST SP 800-63A-4](ht
- GlossaryPasskey
A passkey is a WebAuthn public-key credential that replaces a password. Possession of the authenticator plus a user verification step proves identity, with no s
- ExpertLead author, NIST SP 800-63-3
Paul Grassi led NIST SP 800-63-3 with Michael Garcia and James Fenton in NIST's Applied Cybersecurity Division. The 2017 revision restructured federal digital i
- BlogNIST Digital Identity Guidelines (SP 800-63-4): from draft to final
NIST's rewrite of the Digital Identity Guidelines reached final publication in July 2025 after roughly four years and about 6,000 public comments. It brings syn
- BlogNIST opens an implementation hub for SP 800-63-4, with machine-readable conformance criteria
NIST launched a resource site for the Digital Identity Guidelines, Revision 4, with FAQs, version 0.1 conformance criteria in Excel, PDF and OSCAL, a subscriber