NIST PIV and digital identity SP 800-63-3 → SP 800-63-4
Published 2025-07-31
Snapshot taken 2026-10-19 23:50 · sp-800-63 source
Snapshot taken 2026-10-19 23:50 · sp-800-63 source
+ 32 added: 2.2.1, 2.3.1, 2.3.2, 3.1, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.3…
− 26 removed: 4, 4.1, 4.2, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.4, 4.4.1, 4.4.2…
~ 11 revised: 1, 2, 2.1, 2.2, 2.3, 2.4, 2.5, 2.5.1, 2.5.2, 2.5.3…
Why this release, in the publisher's words
Planning Note (10/06/2026): The Implementation Resource Hub for SP 800-63-4 is now available!
https://csrc.nist.gov/pubs/sp/800/63/4/finalAll · 691 Control tailoring. Control tailoring allows organizations to make informed risk- · 12 Continuous improvement programs. Establishing a continuous evaluation · 123 Digital Identity Risk Management · 304 Digital Identity Model · 105 Digital Identity Risk Management · 96 Selecting Assurance Levels · 57 Federation Considerations · 18 References · 1
Controls added, removed or revised 69
| Control | Title | Change |
|---|---|---|
| 1 | Control tailoring. Control tailoring allows organizations to make informed risk- | Control text, Title |
| 2 | Continuous improvement programs. Establishing a continuous evaluation | Control text, Title |
| 2.1 | Overview | Control text, Title |
| 2.2 | Identity Proofing and Enrollment | Control text, Title |
| 2.2.1 | Subscriber Accounts | added |
| 2.3 | Authentication and Authenticator Management | Control text, Title |
| 2.3.1 | Authenticators | added |
| 2.3.2 | Authentication Process | added |
| 2.4 | Federation and Assertions | Control text, Title |
| 2.5 | Examples of Digital Identity Models | Control text, Title |
| 2.5.1 | Non-Federated Digital Identity Model | Control text, Title |
| 2.5.2 | Federated Digital Identity Model With General-Purpose IdP | Control text, Title |
| 2.5.3 | Federated Digital Identity Model with Subscriber-Controlled Wallet | Control text, Title |
| 3 | Digital Identity Risk Management | Control text, Title |
| 3.1 | Define the Online Service | added |
| 3.2 | Conduct Initial Impact Assessment | added |
| 3.2.1 | Identify Impact Categories and Potential Harms | added |
| 3.2.2 | Identify Potential Impact Levels | added |
| 3.2.3 | Impact Analysis | added |
| 3.2.4 | Determine the Combined Impact Level for Each User Group | added |
| 3.3 | Select Initial Assurance Levels and Baseline Controls | added |
| 3.3.1 | Assurance Levels | added |
| 3.3.2 | Assurance Level Descriptions | added |
| 3.3.2.1 | Identity Assurance Level | added |
| 3.3.2.2 | Authentication Assurance Level | added |
| 3.3.2.3 | Federation Assurance Level | added |
| 3.3.3 | Initial Assurance Level Selection | added |
| 3.3.3.1 | Selecting Initial IAL | added |
| 3.3.3.2 | Selecting Initial AAL | added |
| 3.3.3.3 | Selecting Initial FAL | added |
| 3.3.4 | Identify Baseline Controls | added |
| 3.4 | Tailor and Document Assurance Levels | added |
| 3.4.1 | Assess Privacy, Customer Experience, and Threat Resistance | added |
| 3.4.2 | Identify Compensating Controls | added |
| 3.4.3 | Identify Supplemental Controls | added |
| 3.4.4 | Digital Identity Acceptance Statement | added |
| 3.5 | Continuously Evaluate and Improve | added |
| 3.5.1 | Evaluation Inputs | added |
| 3.5.2 | Performance Metrics | added |
| 3.5.3 | Measurement in Support of Customer Experience Outcomes | added |
| 3.6 | Redress | added |
| 3.7 | Cybersecurity, Fraud, and Identity Program Integrity | added |
| 3.8 | Artificial Intelligence and Machine Learning in Identity Systems | added |
| 4 | Digital Identity Model | removed |
| 4.1 | Overview | removed |
| 4.2 | Enrollment and Identity Proofing | removed |
| 4.3 | Authentication and Lifecycle Management | removed |
| 4.3.1 | Authenticators | removed |
| 4.3.2 | Credentials | removed |
| 4.3.3 | Authentication Process | removed |
| 4.4 | Federation and Assertions | removed |
| 4.4.1 | Assertions | removed |
| 4.4.2 | Relying Parties | removed |
| 5 | Digital Identity Risk Management | removed |
| 5.1 | Overview | removed |
| 5.2 | Assurance Levels | removed |
| 5.3 | Risk and Impacts | removed |
| 5.3.1 | Business Process vs. Online Transaction | removed |
| 5.3.2 | Impacts per Category | removed |
| 5.4 | Risk Acceptance and Compensating Controls | removed |
| 5.5 | Digital Identity Acceptance Statement | removed |
| 5.6 | Migrating Identities | removed |
| 6 | Selecting Assurance Levels | removed |
| 6.1 | Selecting IAL | removed |
| 6.2 | Selecting AAL | removed |
| 6.3 | Selecting FAL | removed |
| 6.4 | Combining x ALs | removed |
| 7 | Federation Considerations | removed |
| 8 | References | removed |
Read every requirement in this version · All versions of NIST PIV and digital identity