3.3.4 Identify Baseline Controls

Before · SP 800-63-3

After · SP 800-63-4

Identify Baseline Controls

Before · SP 800-63-3

After · SP 800-63-4

The selection of the initial assurance levels for each user group and each of the applicable identity functions (i.e., IAL, AAL, and FAL) serves as the basis for selecting the baseline digital identity controls from the guidelines in companion volumes [SP800-63A] , [SP800-63B] , and [SP800-63C] . As described in Sec. 3.4 , the baseline controls include technical and process controls that will be assessed against additional potential impacts.

Using the initial xALs selected in Sec. 3.3.3 , the organization SHALL identify the applicable baseline controls for each user group as follows:

• Initial IAL and related technical and process controls from [SP800-63A]
• Initial AAL and related technical and process controls from [SP800-63B]
• Initial FAL and related technical and process controls from [SP800-63C]

While online service providers must assess and determine the xALs that are appropriate for protecting their applications, the selection of these assurance levels does not mean that the online service provider must implement the related technical and process controls independently. Based on the identity model that the online service provider implements, some or all of the assurance levels and related controls may be implemented by an external entity, such as a third-party CSP or IdP.

The output of this step is a set of assigned xALs and baseline controls for each user group.