BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

3.2.4 Determine the Combined Impact Level for Each User Group

NIST PIV and digital identity SP 800-63-4 against SP 800-63-3
All changes in this version
added 3 Digital Identity Risk Management part of 3.2

Title changed

Before · SP 800-63-3

After · SP 800-63-4

Determine the Combined Impact Level for Each User Group

Control changed

Before · SP 800-63-3

After · SP 800-63-4

The impact assessment levels for each user group are combined to establish a single impact level to represent the risks to impacted entities from a compromise of identity proofing, authentication, and/or federation functions for that user group.

Organizations can apply a variety of methods for this combinatorial analysis, such as:

• Using a high-water mark approach across the various impact categories and impacted entities to derive the effective impact level

• Assigning different weights to different impact categories and/or impacted entities and taking an average to derive the effective impact level

• Some other combinatorial logic that aligns with the organization’s mission and priorities Organizations SHALL document the approach they use to combine their impact assessment into an overall impact level for each of their defined user groups and SHALL apply it consistently across all of its online services. At the conclusion of the combinatorial analysis, organizations SHALL document the impact for each user group.

The outcome of this step is an effective impact level for each user group due to a compromise of the identity management system functions (i.e., identity proofing, authentication, federation).