BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2 Continuous improvement programs. Establishing a continuous evaluation (was: Introduction)

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
modified 2 Continuous improvement programs. Establishing a continuous evaluation

Title changed

Before · SP 800-63-3

Introduction

After · SP 800-63-4

IntroductionContinuous improvement programs. Establishing a continuous evaluation

Control changed

Before · SP 800-63-3

This section is informative.

Digital identity is the unique representation of a subject engaged in an online transaction. A digital identity is always unique in the context of a digital service, but does not necessarily need to uniquely identify the subject in all contexts. In other words, accessing a digital service may not mean that the subject’s real-life identity is known. Identity proofing establishes that a subject is who they claim to be. Digital authentication is the process of determining the validity of one or more authenticators used to claim a digital identity. Authentication establishes that a subject attempting to access a digital service is in control of the technologies used to authenticate. Successful authentication provides reasonable risk-based assurances that the subject accessing the service today is the same as that which previously accessed the service. Digital identity presents a technical challenge because this process often involves proofing individuals over an open network, and typically involves the authentication of individual subjects over an open network to access digital government services. There are multiple opportunities for impersonation and other attacks that fraudulently claim another subject’s digital identity.

This recommendation provides agencies with technical guidelines for digital authentication of subjects to federal systems over a network. This recommendation also provides guidelines for credential service providers (CSPs), verifiers, and relying parties (RPs).

These guidelines describe the risk management processes for selecting appropriate digital identity services and the details for implementing identity assurance, authenticator assurance, and federation assurance levels based on risk. Risk assessment guidance in these guidelines supplements the NIST Risk Management Framework [ NIST RMF ] and its component special publications. This guideline does not establish additional risk management processes for agencies. Rather, requirements contained herein provide specific guidance related to digital identity risk while executing all relevant RMF lifecycle phases.

Digital authentication supports privacy protection by mitigating risks of unauthorized access to individuals’ information. At the same time, because identity proofing, authentication, authorization, and federation involve the processing of individuals’ information, these functions can also create privacy risks. These guidelines therefore include privacy requirements and considerations to help mitigate potential associated privacy risks.

These guidelines support the mitigation of the negative impacts induced by an authentication error by separating the individual elements of identity assurance into discrete, component parts. For non-federated systems, agencies will select two components, referred to as Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL) . For federated systems, a third component, Federation Assurance Level (FAL) , is included. Section 5, Digital Identity Risk Management provides details on the risk assessment process. Section 6, Selecting Assurance Levels combines the results of the risk assessment with additional context to support agency selection of the appropriate IAL, AAL, and FAL combinations based on risk. These guidelines do not consider nor result in a composite level of assurance (LOA) in the context of a single ordinal that drives implementation-specific requirements. Rather, by combining appropriate risk management for business, security, and privacy side-by-side with mission need, agencies will select IAL, AAL, and FAL as distinct options. Specifically, this document does not recognize the four LOA model previously used by federal agencies and described in OMB M-04-04 , instead requiring agencies to individually select levels corresponding to each function being performed. While many systems will have the same numerical level for each IAL, AAL, and FAL, this is not a requirement, and agencies should not assume they will be the same in any given system or application.

The components of identity assurance detailed in these guidelines are as follows:

• IAL refers to the identity proofing process.
• AAL refers to the authentication process.
• FAL refers to the assertion protocol used in a federated environment to communicate authentication and attribute information (if applicable) to an RP.

As such, SP 800-63 is organized as a suite of volumes as follows:

SP 800-63 Digital Identity Guidelines : Provides the risk assessment methodology and an overview of general identity frameworks, using authenticators, credentials, and assertions together in a digital system, and a risk-based process of selecting assurance levels. SP 800-63 contains both normative and informative material.

SP 800-63A Enrollment and Identity Proofing : Addresses how applicants can prove their identities and become enrolled as valid subjects within an identity system. It provides requirements for processes by which applicants can both proof and enroll at one of three different levels of risk mitigation in both remote and physically-present scenarios. SP 800-63A contains both normative and informative material.

SP 800-63B Authentication and Lifecycle Management : Addresses how an individual can securely authenticate to a CSP to access a digital service or set of digital services. This volume also describes the process of binding an authenticator to an identity. SP 800-63B contains both normative and informative material.

SP 800-63C Federation and Assertions : Provides requirements on the use of federated identity architectures and assertions to convey the results of authentication processes and relevant identity information to an agency application. Furthermore, this volume offers privacy-enhancing techniques to share information about a valid, authenticated subject, and describes methods that allow for strong multi-factor authentication (MFA) while the subject remains pseudonymous to the digital service. SP 800-63C contains both normative and informative material.

NIST anticipates that individual volumes in these guidelines will be revised asynchronously. At any time, the most recent revision of each should be used (e.g., if at a time in the future SP 800- 63A-1 and SP 800-63B-2 are the most recent revisions of each volume, they should be used together even though the revision numbers do not match). To minimize the risk of compatibility errors, a reference to the base document (i.e., SP 800-63 rather than SP 800-63-3) always refers to the current version of the document.

The following table states which sections of this volume are normative and which are informative:

Table 2-1 Normative and Informative Sections of SP 800-63-3

Section Name Normative/Informative

After · SP 800-63-4

This section is informative.

Digital identity is the unique representation of a subject engaged in an online transaction. A digital identity isprogram alwaysprovides uniqueorganizations inwith the context of a digital service, but does not necessarily needability to uniquely identify the subject in all contexts. In other words, accessing a digital service may not mean that the subject’s real-life identity is known. Identity proofing establishes that a subjectevaluate ishow whowell they claim to be. Digital authentication isare themitigating processrisks ofand determiningmeeting the validityneeds of one ortheir moreusers. authenticatorsThrough usedmetrics toand claimcross- afunctional digitalassessment identity.programs, Authenticationthis establishesguideline thatsets a subject attempting tofoundation accessfor a digital service is in control of the technologiesdata-driven usedapproach to authenticate. Successful authentication provides reasonable risk-based assurances that the subject accessing the service today is the same as that which previously accessed the service. Digital identity presents a technical challenge because this process often involves proofing individuals over an openproviding networkeffective, and typically involves the authentication of individual subjects over an open network to access digital government services. There are multiple opportunities for impersonation and othermodern attackssolutions that fraudulently claimsupport anotherorganizations’ subject’sextensive digitaluser identitypopulations.

This recommendation provides agencies with technical guidelines for digital authenticationThese oftwo subjectsconcepts toare federaldiscussed systemsin overdetail ain networkSec. This recommendation also provides guidelines for credential service providers (CSPs), verifiers, and3 relyingof partiesthis (RPs)document.

These guidelines describe the risk management processes for selecting appropriate digital identity services and the detailsAs fora implementingpart identityof assurance,improving authenticatorcustomer assuranceexperience, and federation assurance levels based on risk. Risk assessment guidance in these guidelines supplements the NIST Risk Management Framework [ NIST RMF ] and its component special publications. This guideline does not establish additional risk management processes for agencies.also Rather,emphasize requirementsthe containedneed hereinto provide specificoptions guidancefor relatedusers to digital identity risk while executing“meet allthe relevantcustomer RMFwhere lifecyclethey phasesare.

Digital” authenticationWhen supportscoupled privacywith protectiona bycontinuous mitigatingimprovement risksstrategy ofand unauthorizedcustomer-centered accessdesign, tothis individuals’can information.help Atidentify the same timeopportunities, because identity proofingprocesses, authentication,business authorizationpartners, and federation involve the processing of individuals’ information, these functions can also create privacy risks. These guidelines therefore includemulti-channel privacyidentity requirementsproofing and considerations to help mitigate potentialservice associateddelivery privacymethods risks.

Thesethat guidelinesbest support the mitigationneeds of the negative impacts inducedpopulations bythat an authentication error by separating the individual elements of identity assurance into discrete, componentorganization partsserves. For non-federated systems

Additionally, agencies will select two components,usability referredrefers to as Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL) .the Forextent federatedto systems,which a third component, Federation Assurance Level (FAL) , is included. Section 5system, Digital Identity Risk Management provides details on the risk assessment process. Section 6product, Selecting Assurance Levels combines the results of the riskor assessmentservice withcan additionalbe contextused to support agency selection ofachieve thegoals appropriatewith IALeffectiveness, AALefficiency, and FAL combinations based on risk. These guidelines do not consider nor resultsatisfaction in a composite level of assurance (LOA) in thespecified context of a single ordinal that drives implementation-specific requirementsuse. Rather, by combining appropriate risk management for business,Usability security,supports andthe privacymajor side-by-sideobjectives withof missioncustomer needexperience, agencies will select IAL,service AALdelivery, and FAL as distinct options. Specificallysecurity, this document does not recognize the four LOA model previously used by federal agencies and described in OMB M-04-04 , instead requiring agencies to individually select levels corresponding to each function being performed. While manyrequires systemsan willunderstanding haveof the same numerical level for each IAL, AAL, and FAL,people thiswho isinteract notwith a requirement, and agencies should not assume they will be the same in anydigital givenidentity system or application.

The components of identity assurance detailed in these guidelines are as follows:

• IAL refers to the identity proofing process.
• AAL refers to the authentication process.
• FAL refers to the assertion protocol used in a federated environment to communicate authentication and attribute information (if applicable) to an RP.

As such, SP 800-63 is organized as a suite of volumeswell as follows:

SP 800-63 Digital Identity Guidelines : Provides the risk assessment methodology and an overview of general identity frameworks, using authenticators, credentials, and assertions together in atheir digitalunique system,capabilities and a risk-based processcontext of selecting assurance levels. SP 800-63 contains both normative and informative materialuse.

SP 800-63A Enrollment and Identity Proofing : Addresses how applicants can prove their identities and become enrolled as valid subjects within anReaders identityof system.this Itguideline providesshould requirementstake fora processesholistic byapproach whichto applicantsconsidering canthe bothinteractions proofthat andeach enrolluser atwill oneengage ofin threethroughout differentthe levelsprocess of risk mitigationenrolling in both remote and physically-present scenarios. SP 800-63A contains both normative and informative material.

SP 800-63B Authentication and Lifecycle Management : Addresses how an individual can securely authenticate to a CSPauthenticating to access a digital service or set of digital services. This volume also describes the process of binding an authenticator to an identity. SP 800-63B contains both normative and informative material.

SP 800-63C Federation and Assertions : Provides requirements onThroughout the use of federated identity architecturesdesign and assertions to convey the resultsdevelopment of authentication processes anda relevantdigital identity information to an agencysystem application.or Furthermoreprocess, this volume offersit privacy-enhancingis techniquesimportant to share informationconduct aboutusability aevaluations valid,with authenticatedrepresentative subject,users and describes methods that allow for strong multi-factor authentication (MFA)perform whilerealistic thescenarios subjectand remainstasks pseudonymousin toappropriate thecontexts digitalof serviceuse. SP 800-63CAdditionally, containsfollowing bothusability normativeguidelines and informative material.

NIST anticipates that individualconsiderations volumescan inhelp theseorganizations guidelinesmeet willtheir becustomer revisedexperience asynchronouslygoals. At any time, the most recentDigital revisionidentity ofmanagement eachprocesses should be used (e.g., if at a time in the future SP 800- 63A-1designed and SP 800-63B-2 are the most recent revisions of each volume, they shouldimplemented beso usedthat togetherit evenis thougheasy thefor revisionusers numbersto do not match). To minimize the risk of compatibilityright errorsthing, a referencehard to thedo basethe documentwrong (i.e.thing, SP 800-63 rather than SP 800-63-3) alwaysand referseasy to the current versionrecover ofwhen the document.

The following table states which sections of this volume are normative and which are informative:

Table 2-1 Normative and Informative Sections of SP 800-63-3

Sectionwrong Namething Normative/Informativehappens.