5.4 Risk Acceptance and Compensating Controls
All changes in this version
Title changed
Before · SP 800-63-3
Risk Acceptance and Compensating Controls
After · SP 800-63-4
Risk Acceptance and Compensating Controls
Control changed
Before · SP 800-63-3
The SP 800-63 suite specifies baseline requirements for digital identity services based on assurance level. Agencies SHOULD implement identity services per the requirements in these guidelines and SHOULD consider additional techniques and technologies to further secure and privacy-enhance their services. Agencies MAY determine alternatives to the NIST-recommended guidance, for the assessed x ALs, based on their mission, risk tolerance, existing business processes, special considerations for certain populations, availability of data that provides similar mitigations to those described in this suite, or due to other capabilities that are unique to the agency.
Agencies SHALL demonstrate comparability of any chosen alternative, to include any compensating controls, when the complete set of applicable SP 800-63 requirements is not implemented. For example, an agency may choose a National Information Assurance Partnership (NIAP) protection profile over FIPS, where the profile is equivalent to or stronger than the FIPS requirements. That said, agencies SHALL NOT alter the assessed x AL based on agency capabilities. Rather, the agency MAY adjust their implementation of solutions based on the agency’s ability to mitigate risk via means not explicitly addressed by SP 800-63 requirements. The agency SHALL implement procedures to document both the justification for any departure from normative requirements and detail the compensating control(s) employed.
This guidance addresses only those risks associated with authentication and identity proofing errors. NIST Special Publication 800-30 , Risk Management Guide for Information Technology Systems [ SP 800-30 ] recommends a general methodology for managing risk in federal systems.
After · SP 800-63-4
The SP 800-63 suite specifies baseline requirements for digital identity services based on assurance level. Agencies SHOULD implement identity services per the requirements in these guidelines and SHOULD consider additional techniques and technologies to further secure and privacy-enhance their services. Agencies MAY determine alternatives to the NIST-recommended guidance, for the assessed x ALs, based on their mission, risk tolerance, existing business processes, special considerations for certain populations, availability of data that provides similar mitigations to those described in this suite, or due to other capabilities that are unique to the agency.
Agencies SHALL demonstrate comparability of any chosen alternative, to include any compensating controls, when the complete set of applicable SP 800-63 requirements is not implemented. For example, an agency may choose a National Information Assurance Partnership (NIAP) protection profile over FIPS, where the profile is equivalent to or stronger than the FIPS requirements. That said, agencies SHALL NOT alter the assessed x AL based on agency capabilities. Rather, the agency MAY adjust their implementation of solutions based on the agency’s ability to mitigate risk via means not explicitly addressed by SP 800-63 requirements. The agency SHALL implement procedures to document both the justification for any departure from normative requirements and detail the compensating control(s) employed.
This guidance addresses only those risks associated with authentication and identity proofing errors. NIST Special Publication 800-30 , Risk Management Guide for Information Technology Systems [ SP 800-30 ] recommends a general methodology for managing risk in federal systems.