2.1 Overview (was: Applicability)
All changes in this version
Title changed
Before · SP 800-63-3
Applicability
After · SP 800-63-4
ApplicabilityOverview
Control changed
Before · SP 800-63-3
Not all digital services require authentication or identity proofing; however, this guidance applies to all such transactions for which digital identity or authentication are required, regardless of the constituency (e.g. citizens, business partners, government entities).
Transactions not covered by this guidance include those associated with national security systems as defined in 44 U.S.C. § 3542(b)(2). Private sector organizations and state, local, and tribal governments whose digital processes require varying levels of assurance may consider the use of these standards where appropriate.
These guidelines primarily focus on agency services that interact with the non-federal workforce, such as citizens accessing benefits or private sector partners accessing information sharing collaboration spaces. However, it also applies to internal agency systems accessed by employees and contractors. These users are expected to hold a valid government-issued credential, primarily the Personal Identity Verification (PIV) card or a derived PIV. Therefore SP 800-63A and SP 800-63B are secondary to the requirements of FIPS 201 and its corresponding set of special publications and agency-specific instructions. However, SP 800-63C and the risk-based selection of an appropriate FAL applies, regardless of the credential type the internal user holds. FAL selection provides agencies guidance and flexibility in how to PIV-enable their applications based on system risk.
After · SP 800-63-4
NotThese allguidelines use digital servicesidentity requiremodels authenticationthat orreflect identitytechnologies proofing;and however,architectures thisthat guidanceare appliescurrently toavailable allin suchthe transactionsmarket. forThese whichmodels digitalhave identitya orvariety authenticationof areentities required,and regardlessfunctions ofand thevary constituencyin complexity. Simple models group functions (e.g. citizens, businesscreating partnerssubscriber accounts, governmentproviding entitiesattributes) under a single entity. More complex models separate these functions among multiple entities.TransactionsThe notroles coveredand byfunctions thisfound guidancein these digital identity models include:
Subject those: associatedIn withthese nationalguidelines, securitya systemssubject asis defineda person and is represented by one of three roles, depending on where they are in 44the U.S.C.digital §identity 3542(b)(2)process.
• PrivateApplicant sector— organizationsA subject to be identity-proofed and state,enrolled.
• local,Subscriber — A subject who has successfully completed the identity proofing and tribalenrollment governmentsprocess whoseor digitalwho processeshas requirebeen varyingsuccessfully levelsauthenticated ofto assurancean mayonline considerservice.
• theClaimant use— ofA thesesubject standards“making wherea appropriateclaim” to be eligible for authentication.TheseService guidelinesprovider primarily: focusService onproviders agencycan servicesperform thatany interactcombination withof thefunctions non-federalinvolved workforcein granting access to and delivering online services, such as citizensa accessingcredential benefitsservice orprovider, privaterelying sectorparty, partnersverifier, accessingand informationidentity sharingprovider.
Credential collaborationservice spaces.provider However(CSP) : CSP functions include identity proofing applicants, itenrolling alsothem appliesinto their identity service, establishing subscriber accounts, and binding authenticators to internalthose agencyaccounts. systemsA accessedsubscriber byaccount employeesis the CSP’s established record of the subscriber, the subscriber’s attributes, and contractorsassociated authenticators. TheseCSP usersfunctions aremay expectedbe toperformed holdby an independent third party.
Relying party (RP) : RPs provide online transactions and services and rely upon a validverifier’s government-issuedassertion credentialof a subscriber’s identity to grant access to those services. When using federation, primarilythe RP accesses the Personalinformation Identityin Verificationthe subscriber account through assertions from an identity provider (PIVIdP).
Verifier card: orA averifier derivedconfirms PIV.the Thereforeclaimant’s SPidentity 800-63Aby verifying the claimant’s possession and SPcontrol 800-63Bof areone secondaryor more authenticators using an authentication protocol. To do this, the verifier needs to confirm the requirementsbinding of FIPSthe 201authenticators andwith itsthe correspondingsubscriber setaccount ofand specialcheck publicationsthat andthe agency-specificsubscriber instructionsaccount is active.
Identity Howeverprovider (IdP) : When using federation, SPthe 800-63CIdP manages the subscriber’s primary authenticators and issues assertions derived from the risk-basedsubscriber selectionaccount. ofWhile anpresented appropriateas FALseparate appliesroles, regardlessthe functions of the credentialCSP, typeverifier, theand internalIdP usermay holds.be FALperformed selectionby providesa agenciessingle guidanceentity andor flexibilitydistributed inacross howmultiple toentities, PIV-enabledepending theiron applicationsthe basedimplementation on(see systemSec. risk2.5).