NIST SP 800-63-4: Digital Identity Guidelines, explained

NIST Special Publication 800-63, "Digital Identity Guidelines," sets technical requirements for identity proofing, authenticators, authentication protocols and federation for people interacting with US government information systems over a network. The current revision, SP 800-63-4, was published in July 2025. It supersedes SP 800-63-3 — originally published in June 2017, with Update 2 issued 2 March 2020 — which NIST formally withdrew on 1 August 2025. The guidelines do not define identity itself; they define how confident a system can be that a specific digital credential belongs to the person, device or service presenting it, and they split that confidence into three separately-scored dimensions.

A four-document suite

SP 800-63-4 is the base volume that introduces shared concepts and the assurance-level model; three companion volumes carry the detailed technical requirements for each stage of a digital identity transaction:

Volume	Covers
SP 800-63-4	Base document — identity model, risk assessment, assurance-level overview
SP 800-63A-4	Identity proofing and enrollment
SP 800-63B-4	"Authentication and Authenticator Management" — authenticators and credential lifecycle, including the three Authenticator Assurance Levels
SP 800-63C-4	Federation and assertions between identity providers and relying parties

Three assurance-level scales

Rather than a single score, SP 800-63-4 keeps identity proofing, authentication and federation strength on three separate 1–3 scales, so a system can be tuned independently on each axis instead of forcing one blended rating:

Level	Identity Assurance Level (IAL)	Authenticator Assurance Level (AAL)	Federation Assurance Level (FAL)
1	Validates core attributes against authoritative sources; supports "the real-world existence of the claimed identity."	"Basic confidence that the claimant controls an authenticator bound to the subscriber account," single- or multi-factor.	"A basic level of protection for federation transactions," supporting a wide range of use cases.
2	"Requires collecting additional evidence and a more rigorous process for validating the evidence and verifying the identity."	"High confidence"; proof of possession and control of two distinct authentication factors is required.	"A high level of protection," including defenses against attempts to inject assertions.
3	Adds a trained representative who interacts directly with the applicant and collects at least one biometric.	"Very high confidence," requiring a public-key cryptographic authenticator that provides phishing resistance.	"Very high confidence that the information communicated in the federation transaction matches what was established by" the identity and credential service providers.

A system's overall posture is typically expressed as a triple — e.g. IAL2/AAL2/FAL1 — rather than one number, since a service might need strong proof of who someone is at enrollment (IAL2) without requiring federation at all (no FAL applicable).

What changed from SP 800-63-3

SP 800-63-4 is a substantive revision, not an editorial update. Beyond the three-volume renumbering (each companion document moved from -3 to -4), the base document and its NIST summary describe several structural changes:

• IAL1 repurposed to explicitly address synthetic-identity and compromised-information attacks, rather than only describing a low-rigor proofing tier.
• Phishing resistance emphasized as an explicit authenticator property, with new guidance steering AAL3 implementations toward phishing-resistant authenticators specifically.
• Risk-based rather than compliance-oriented framing — the revision promotes selecting assurance levels and controls based on an organization's own risk analysis instead of treating the levels as a fixed checklist.
• Baseline tailoring mechanisms that let an organization adjust controls within a level based on documented risk decisions.
• Continuous evaluation expectations, including performance metrics for identity programs over time rather than a one-time assessment.
• Preparation for newer credential formats, including mobile driver's licenses and verifiable credentials, which did not exist in meaningful deployment when SP 800-63-3 was written in 2017.

Why this matters beyond federal IT

SP 800-63-4's assurance-level vocabulary (IAL/AAL/FAL) has become a common reference point well beyond the federal systems it formally governs, including for device manufacturers deciding how strongly to authenticate firmware updates, cloud-connected companion apps, or API keys embedded in a product. A device maker evaluating its own authentication design can use the AAL definitions above as an external, numbered yardstick — e.g. "does our default pairing flow meet AAL1, or does it rely on a shared secret with no proof of possession at all" — without needing to adopt the full federal identity-proofing process the proofing volume (SP 800-63A-4) describes.

SoftWSP's firmware and device assessments check authenticator design (default credentials, key management, update signing) against external baselines like SP 800-63B-4 rather than against an internal, unstated bar: see device firmware security.

This guide summarises a public NIST publication; it does not constitute legal or compliance advice.