3.3.2.1 Identity Assurance Level

Before · SP 800-63-3

After · SP 800-63-4

Identity Assurance Level

Before · SP 800-63-3

After · SP 800-63-4

• IAL1: IAL1 supports the real-world existence of the claimed identity and provides some assurance that the applicant is associated with that identity. Core attributes are obtained from identity evidence or self-asserted by the applicant. All core attributes are validated against authoritative or credible sources, and steps are taken to link the attributes to the person undergoing the identity proofing process.

• IAL2: IAL2 requires collecting additional evidence and a more rigorous process for validating the evidence and verifying the identity.

• IAL3: IAL3 adds the requirement for a trained CSP representative (i.e., proofing agent) to interact directly with the applicant, as part of an on-site attended identity proofing session, and the collection of at least one biometric.

Table 1 describes the control objectives (i.e., attack protections) for each identity assurance level. Table 1. IAL Summary

IAL Control Objectives User Profile IAL1 Limit highly scalable attacks. Protect against synthetic identity. Protect against attacks that use compromised personal information. Access to personal information is required but limited. User actions are limited (e.g., viewing and making modifications to individual personal information). Fraud cannot be directly perpetrated through available user functions. Users cannot receive payments until an offline or manual process is conducted. IAL2 Limit scaled and targeted attacks. Protect against basic evidence falsification and theft. Protect against basic social engineering. Users can view and change financial information (e.g., a direct deposit location). Individuals can directly perpetrate financial fraud through the available application functionality. A user can view or modify other users’ personal information. Users have visibility into or access to proprietary information. IAL3 Limit sophisticated attacks. Protect against advanced evidence falsification, theft, and repudiation. Protect against advanced social engineering attacks. Users have direct access to multiple highly sensitive records; administrator access to servers, systems, or security data; the ability to access large sets of data that may reveal sensitive information about one or many users; or access that could result in a breach that would constitute a major incident under OMB guidance.