What are the NIST Digital Identity Guidelines (SP 800-63), and how do they split assurance into separate dimensions?
A US guideline for implementing digital identity in federal agencies, which rates three things separately: identity proofing (IAL), authentication (AAL) and federation (FAL), each on levels 1 to 3.
NIST Special Publication 800-63 is written for US government agencies, but it is read worldwide as the reference for digital identity. The current version is SP 800-63-4, published in July 2025, which superseded 800-63-3. It consists of a base volume plus three companion volumes:
| Dimension | Volume | Question it answers |
|---|---|---|
| IAL, Identity Assurance Level | 800-63A | How well was the person's real-world identity proven at enrolment? |
| AAL, Authentication Assurance Level | 800-63B | How strongly does the login prove control of the bound authenticators? |
| FAL, Federation Assurance Level | 800-63C | How well is the assertion protected when an identity provider passes the result to an RP? |
The key design idea is to decouple the dimensions. A service may need strong authentication (AAL2) but no proofing at all (a pseudonymous forum), or full proofing (IAL2) for a benefit claim. A single combined level would force one to over- or under-provision. The Swiss eCH-0170 model follows a similar sub-model structure and maps its levels onto IAL, AAL and FAL.
Go deeper:
NIST SP 800-63-4 Digital Identity Guidelines — the web edition of the base volume and its three companion volumes.- NIST CSRC: SP 800-63-4 (final) — publication record, July 2025, superseding SP 800-63-3.