6.4 Combining x ALs
All changes in this version
Title changed
Before · SP 800-63-3
Combining x ALs
After · SP 800-63-4
Combining x ALs
Control changed
Before · SP 800-63-3
This guideline introduces a model where individual x ALs can be selected without requiring parity to each other. While options exist to select varying x ALs for a system, in many instances the same level will be chosen for all x ALs.
The ability to combine varying x ALs offers significant flexibility to agencies, but not all combinations are possible due to the nature of the data collected from an individual and the authenticators to protect that data. Table 6-2 details valid combinations of IAL and AAL to ensure personal information remains protected by MFA.
Table 6-2 Acceptable Combinations of IAL and AAL
AAL1 AAL2 AAL3
IAL1: Without personal data Allowed Allowed Allowed
IAL1: With personal data NO Allowed Allowed
IAL2 NO Allowed Allowed
IAL3 NO Allowed Allowed
Note: Per Executive Order 13681 [ EO 13681 ], the release of personal data requires protection with MFA, even if the personal data is self-asserted and not validated. When the transaction does not make personal data accessible, authentication may occur at AAL1, although providing an option for the user to choose stronger authentication is recommended. In addition, it may be possible at IAL1 to self-assert information that is not personal, in which case AAL1 is acceptable.
After · SP 800-63-4
This guideline introduces a model where individual x ALs can be selected without requiring parity to each other. While options exist to select varying x ALs for a system, in many instances the same level will be chosen for all x ALs.
The ability to combine varying x ALs offers significant flexibility to agencies, but not all combinations are possible due to the nature of the data collected from an individual and the authenticators to protect that data. Table 6-2 details valid combinations of IAL and AAL to ensure personal information remains protected by MFA.
Table 6-2 Acceptable Combinations of IAL and AAL
AAL1 AAL2 AAL3
IAL1: Without personal data Allowed Allowed Allowed
IAL1: With personal data NO Allowed Allowed
IAL2 NO Allowed Allowed
IAL3 NO Allowed Allowed
Note: Per Executive Order 13681 [ EO 13681 ], the release of personal data requires protection with MFA, even if the personal data is self-asserted and not validated. When the transaction does not make personal data accessible, authentication may occur at AAL1, although providing an option for the user to choose stronger authentication is recommended. In addition, it may be possible at IAL1 to self-assert information that is not personal, in which case AAL1 is acceptable.