NIST SP 800-63
Definition
NIST SP 800-63 is a guideline series for digital identities with specifications on identity proofing, authentication, and federation.
The Digital Identity Guidelines cover identity proofing, authentication, and federation of users (e.g., employees, contractors, or private individuals) who access government information systems over networks. Organizations select a trust level per function with three tiers each: IAL for identity proofing, AAL for authentication, and FAL for federation.
Simply explained
Like an ID check with levels: The more important the access, the more thorough the verification.
Why it matters in practice
Helps secure identity proofing at registration, authentication at login, and federation according to risk, instead of using the same rules for all services.
Example from business
Possible example (hypothetical): A retailer classifies its customer portal by risk and requires stronger authentication for order approvals in the B2B area than for the catalog.
Limits and pitfalls
- Mixing IAL, AAL, and FAL; choosing the same level for all services; citing the superseded Revision 3; ignoring customer experience (usability) in risk assessment.
Origin & history
The final Revision 4 was published in July 2025 after several years of coordination. It replaces Revision 3 from 2017, updated in 2020. The core volume and parts cover identity proofing, authentication, and federation.
Use in mid-sized companies
- Possible applications: Designing customer portals, selecting multi-factor methods, connecting partners via federation, identity proofing at registration.
Frequently asked questions
Does SP 800-63 apply only to US government agencies?
Not only: The summary mentions government information systems, but according to section 1.1 the scope includes online services regardless of user group, and private sector organizations may consider the standards where appropriate, according to the document.
What does AAL mean?
Authentication Assurance Level, i.e., the trust level of authentication.
How many levels are there?
Each of the three levels (IAL, AAL, FAL) has three tiers.
Sources
- NIST SP 800-63-4, Digital Identity Guidelines · Temoshok et al. (2025): NIST SP 800-63-4, Digital Identity Guidelines
- NIST SP 800-63 Digital Identity Guidelines · NIST (2025): NIST SP 800-63 Digital Identity Guidelines
Sources checked on 14.10.2026. Editorial use cases are hypothetical; no evidence of real customer results.
Editorially reviewed on: