5.3 Risk and Impacts
All changes in this version
Title changed
Before · SP 800-63-3
Risk and Impacts
After · SP 800-63-4
Risk and Impacts
Control changed
Before · SP 800-63-3
This section provides details on the impact categories used to determine IAL, AAL, and FAL.
Potential Impact Categories: To determine the appropriate level of assurance of the user’s asserted identity, agencies SHALL assess the potential risks and identify measures to minimize their impact. Authentication, proofing, and federation errors with potentially worse consequences require higher levels of assurance. Business process, policy, and technology may help reduce risk.
Categories of harm and impact include:
1. Inconvenience, distress, or damage to standing or reputation; 2. Financial loss or agency liability; 3. Harm to agency programs or public interests; 4. Unauthorized release of sensitive information; 5. Personal safety; and 6. Civil or criminal violations.
Required assurance levels for digital transactions are determined by assessing the potential impact of each of the above categories using the potential impact values described in Federal Information Processing Standard (FIPS) 199 [ FIPS 199 ].
The three potential impact values are:
1. Low impact, 2. Moderate impact, and 3. High impact.
After · SP 800-63-4
This section provides details on the impact categories used to determine IAL, AAL, and FAL.
Potential Impact Categories: To determine the appropriate level of assurance of the user’s asserted identity, agencies SHALL assess the potential risks and identify measures to minimize their impact. Authentication, proofing, and federation errors with potentially worse consequences require higher levels of assurance. Business process, policy, and technology may help reduce risk.
Categories of harm and impact include:
1. Inconvenience, distress, or damage to standing or reputation; 2. Financial loss or agency liability; 3. Harm to agency programs or public interests; 4. Unauthorized release of sensitive information; 5. Personal safety; and 6. Civil or criminal violations.
Required assurance levels for digital transactions are determined by assessing the potential impact of each of the above categories using the potential impact values described in Federal Information Processing Standard (FIPS) 199 [ FIPS 199 ].
The three potential impact values are:
1. Low impact, 2. Moderate impact, and 3. High impact.