NIST SP 800-63 — Digital Identity Guidelines

Why does it matter?

SP 800-63-4 is where a federal online service gets its identity requirements from. Before it, an agency could not say how much proofing, how strong an authenticator or how protected a federation transaction a service needed without reasoning from scratch; Section 3 turns that into a repeatable, normative process with documented outcomes, and the three xALs give every service a short, comparable statement of its posture. Revision 4 also carries two concepts Section 1.3.3 introduces for the first time, control tailoring and continuous improvement programs, so an agency can adjust baseline controls for its users with a recorded rationale instead of either over-securing a public service or ignoring the guideline.

Key benefits include:

• A defined process with mandatory outcomes

Section 3 requires organizations to execute and document each of the five DIRM steps and their normative outcomes, whatever internal process or tool they use.

• Three independent assurance levels

IAL, AAL and FAL are selected separately for each user group (Section 1.2), and the final implemented xALs do not all need to be at the same level (Section 3.4.4).

• Tailoring with a record

Section 3.4 lets an organization modify an initially assessed assurance level or add compensating and supplemental controls after privacy, customer experience and threat assessments, and Section 3.4.4 requires the Digital Identity Acceptance Statement to record the result.

• Continuous evaluation

Section 3.5 asks for performance metrics (Table 4), evaluation inputs and redress processes, so the selected controls are checked against fraud rates, user impacts and new threats rather than set once.

• Current threat models

Section 1.3.1 lists what this revision adds against identity theft and fraud, from a repurposed IAL1 to phishing-resistant options and protection against automated attacks on enrollment.

How does it work?

Section 2 sets out the digital identity model. In identity proofing and enrollment (2.2) a credential service provider (CSP) establishes a subscriber account; in authentication and authenticator management (2.3) a verifier checks that the claimant controls one or more authenticators bound to that account; in federation (2.4) an identity provider (IdP) asserts the authentication result and attributes to a relying party (RP). Section 2.5 gives three worked models: a non-federated service, a federated service with a general-purpose IdP, and a federated service with a subscriber-controlled wallet. The DIRM process works along two dimensions (Section 3): the risks of a compromise of the online service that an identity system can address, and the risks the identity system itself introduces.

The five steps run in order but may be revisited at any point. Step 1 documents the service's functional scope, user groups and impacted entities. Step 2 assesses each function against defined harms and impact categories, user group by user group, to a combined impact level of low, moderate or high (3.2). Step 3 maps that level to an initial IAL, AAL and FAL and identifies the baseline controls from the companion volumes (3.3). Step 4 conducts or reuses privacy, customer experience and threat-resistance assessments (3.4.1), identifies compensating controls (3.4.2) and supplemental controls (3.4.3), and records everything in the DIAS (3.4.4). Step 5 establishes performance metrics, collects evaluation inputs and updates the DIAS with adjustments (3.5).

Section 3.3.2 describes the levels. IAL1 supports the real-world existence of the claimed identity with core attributes validated against authoritative or credible sources; IAL2 requires additional evidence and a more rigorous validation and verification process; IAL3 adds a trained proofing agent in an on-site attended session and at least one biometric. AAL1 gives basic confidence through single- or multi-factor authentication; AAL2 high confidence through two distinct factors with approved cryptography; AAL3 very high confidence through a public-key authenticator with a non-exportable private key that provides phishing resistance. FAL1 offers basic protection for federation transactions, FAL2 adds protection against injected assertions, and FAL3 gives very high confidence that the transaction matches what the CSP and IdP established (Tables 1 to 3).

Key Elements

• The xALs (Section 1.2)

Identity Assurance Level for proofing, Authentication Assurance Level for authentication and Federation Assurance Level for federated transactions, each with three levels and selected separately.

• Digital identity model (Section 2)

CSP, subscriber account, authenticator, verifier, IdP and RP, with non-federated, general-purpose IdP and subscriber-controlled wallet examples in Section 2.5.

• DIRM process (Section 3, Fig. 6)

Five steps, define the service, assess impact, select initial xALs, tailor and document, evaluate and improve, each with a required outcome; federal RPs SHALL implement it for all online services.

• Initial impact assessment (Section 3.2)

Impact categories and potential harms, impact levels, impact analysis and a combined impact level for each user group.

• Assurance level descriptions (Section 3.3.2, Tables 1 to 3)

IAL1 to IAL3, AAL1 to AAL3 and FAL1 to FAL3 with control objectives and user profiles, for example IAL3 and AAL3 for administrator access or breaches that would be a major incident under OMB guidance.

• Tailoring and the DIAS (Sections 3.4 and 3.4.4)

Privacy, customer experience and threat assessments, compensating and supplemental controls, and a Digital Identity Acceptance Statement with at least the impact results, initial and tailored xALs with rationale, and all compensating and supplemental controls.

• Evaluation, redress, integrity and AI (Sections 3.5 to 3.8)

Performance metrics and evaluation inputs, redress mechanisms, cybersecurity, fraud and identity program integrity, and considerations for artificial intelligence and machine learning in identity systems.

What does it cover?

Section 1.1 applies the guidelines to all online services for which some level of assurance in a digital identity is required, regardless of constituency, with "person" meaning natural persons only. They focus on services for external users such as members of the public and business partners but also apply to federal systems used by employees and contractors, where FIPS 201 and the PIV publications extend them. Excluded are national security systems and physical access control; machine-to-machine authentication, Internet of Things devices and API access on behalf of subjects are not explicitly addressed. Federal relying parties are bound by the normative Section 3; private-sector organizations and state, local and tribal governments may consider the standards where appropriate.

What are its objectives?

The abstract and Sections 1.1 to 1.3 set out what the guidelines are for:

Define technical requirements for identity proofing, enrollment, authenticators, management processes, authentication protocols, federation and assertions for users of government information systems (abstract).

Give organizations a risk-based method, the DIRM process, for selecting the IAL, AAL and FAL that mitigate the identity errors a service faces (Sections 1.2 and 3).

Protect against identity theft and identity-related fraud with updated threat models, phishing-resistant authentication and defenses against automated enrollment attacks (Section 1.3.1).

Weigh privacy and customer experience alongside security through control tailoring and continuous improvement programs (Sections 1.3.2 and 1.3.3).

Document every assurance decision in a Digital Identity Acceptance Statement that federal agencies can include in their RMF authorization package (Section 3.4.4).

Leave room for other standards: the guidelines are not intended to constrain the development or use of standards outside this purpose (abstract).

Framework in Context

SP 800-63-4 is read with its companion volumes: SP 800-63A-4 for proofing, SP 800-63B-4 for authentication, whose Section 2.4.1 requires verifiers to employ tailored controls from the SP 800-53 moderate baseline or an equivalent federal or industry standard, and SP 800-63C-4 for federation. Section 1.3.1 places the suite inside FISMA and the Risk Management Framework, whose controls it augments but does not replace, and recommends that non-federal organizations follow comparable standards such as ISO/IEC 27001. Section 1.3.2 points to the NIST Privacy Framework, the Privacy Act, OMB M-03-22, SP 800-53 and SP 800-122 for privacy obligations. The previous edition, SP 800-63-3, was withdrawn on August 1, 2025, and NIST's Implementation Resource Hub supports the new edition.

Common Framework Mappings

NIST SP 800-63 is commonly mapped to the identity, authentication, privacy and governance standards that reuse its assurance levels, so one set of identity controls and evidence can serve several programs.

Mapped frameworks include:

eIDAS

FIDO2

ISO 27001:2022

ISO 27002:2022

ISO/IEC 29115

NIST CSF 2.0

NIST 800-53 Rev.5

OMB M-19-17