NIST SP 800-63 — Digital Identity (IAL / AAL / FAL)
What it is
NIST Special Publication 800-63, Digital Identity Guidelines — the US standard for how confident you are that a digital user is who they claim to be, how strongly they authenticate, and how trust is carried across federated systems. Revision 4 (SP 800-63-4) was published August 2025, replacing 800-63-3.
Who it applies to
Any federal system (and any platform mapping to FedRAMP / NIST 800-53 IA controls). It’s also the de-facto reference for high-assurance identity in the private sector.
Disclaimer. Not legal/compliance advice. Verify against the live publication. Verified 2026-05-29.
The three assurance levels — now independently selectable
800-63 splits “identity assurance” into three separate dimensions. A major change in 800-63-4 is that these are chosen independently — you don’t pick one bundled level, you assemble the combination your risk assessment requires. This is the à-la-carte model the platform FRD is built around.
| Dimension | Question it answers | Levels |
|---|---|---|
| IAL — Identity Assurance Level | How well did we prove this is a real, specific person? (proofing) | IAL1 / IAL2 / IAL3 |
| AAL — Authenticator Assurance Level | How strong is the login? (authentication) | AAL1 / AAL2 / AAL3 |
| FAL — Federation Assurance Level | How trustworthy is the assertion passed between systems? (SSO) | FAL1 / FAL2 / FAL3 |
IAL — Identity Assurance Level (proofing)
| Level | Requirement |
|---|---|
| IAL1 | No or minimal identity proofing; attributes self-asserted. |
| IAL2 | Identity proofed remotely or in person against reliable evidence (e.g., government ID + verification). Moderate confidence. |
| IAL3 | Highest. Requires physical presence / supervised remote proofing, with verification of evidence by a trained operator. For high-risk scenarios. |
AAL — Authenticator Assurance Level (authentication)
| Level | Requirement |
|---|---|
| AAL1 | Single-factor permitted (e.g., password). |
| AAL2 | Multi-factor required. 800-63-4 requires that a phishing-resistant option be offered. |
| AAL3 | Highest. Hardware-based, phishing-resistant, cryptographic authenticator (e.g., FIDO2/WebAuthn security key, PIV/CAC). Verifier-impersonation resistant. |
FAL — Federation Assurance Level (SSO / assertions)
| Level | Requirement |
|---|---|
| FAL1 | Bearer assertion, signed by the IdP (e.g., standard SAML / OIDC). |
| FAL2 | Assertion is encrypted to the relying party (injection-protected). |
| FAL3 | Highest. Holder-of-key — the assertion is bound to a cryptographic key the subject must prove possession of. |
Highest assurance = IAL3 + AAL3 + FAL3
The platform targets the top of each dimension, implemented as discrete modules:
- IAL3: integrate a supervised/remote identity-proofing provider; store proofing evidence and decisions.
- AAL3: require FIDO2/WebAuthn (security keys / platform authenticators) and PIV/CAC for federal users; disallow SMS OTP at this level.
- FAL3: holder-of-key federation; bind assertions to an authenticator rather than bearer tokens.
Risk-based, not checklist. 800-63-4 reframes selection around Digital Identity Risk Management (DIRM) — you justify each xAL from impact, not by defaulting everyone to the top. The platform supports the highest levels so any deployment can dial down per its own DIRM assessment.
This maps directly to the IA (Identification & Authentication) family of NIST 800-53 and to the SSO functionality discussed in Procurement → Tools and Software.
Related resources
- FedRAMP — inherits these assurance requirements via IA controls
- NIST 800-53 — the IA control family
- FRD: FedRAMP-Compliant Platform Security — identity modules
- Security Overview
Sources (verified 2026-05-29)
| Claim | Source |
|---|---|
| 800-63-4 published Aug 2025; replaces 63-3; IAL/AAL/FAL framework; DIRM | NIST SP 800-63-4 |
| IAL/AAL/FAL definitions and level requirements | NIST SP 800-63-4 (sp800-63-4) |
| Phishing-resistant MFA / AAL3 cryptographic authenticator | NIST SP 800-63B-4 |