NIST PIV and digital identity SP 800-63-4

Controls in this version
Ref	Title	Text
1	Control tailoring. Control tailoring allows organizations to make informed risk-	based decisions to deploy technologies and processes that work for their users and adjust their baseline controls through informed decision-making to meet customer experience needs.	changed here
2	Continuous improvement programs. Establishing a continuous evaluation	program provides organizations with the ability to evaluate how well they are mitigating risks and meeting the needs of their users. Through metrics and cross- functional assessment programs, this guideline sets a foundation for a data-driv	changed here
2.1 in 2	Overview	These guidelines use digital identity models that reflect technologies and architectures that are currently available in the market. These models have a variety of entities and functions and vary in complexity. Simple models group functions	changed here
2.2 in 2	Identity Proofing and Enrollment	[SP800-63A] , Digital Identity Guidelines: Identity Proofing and Enrollment , provides general guidance information and normative requirements for the identity proofing and enrollment processes as well as IAL-specific requirements. [SP800-	changed here
2.2.1 in 2.2	Subscriber Accounts	At the time of enrollment, the CSP establishes a subscriber account to uniquely identify each subscriber and record information about the subscriber and any authenticators bound to that subscriber account. See Sec. 5 of [SP800-63A] , subsc	changed here
2.3 in 2	Authentication and Authenticator Management	[SP800-63B] , Authentication and Authenticator Management , provides normative descriptions of permitted authenticator types, their characteristics (e.g., phishing resistance), and authentication processes appropriate for each AAL. Fig. 1.	changed here
2.3.1 in 2.3	Authenticators	An authenticator is a means of demonstrating the control or possession of one or more factors in an authentication protocol. These guidelines define three types of authentication factors used for authentication: • Something you know (e.g.,	changed here
2.3.2 in 2.3	Authentication Process	The authentication process enables an RP to trust that a claimant is who they say they are to some level of assurance. The sample authentication process in Fig. 2 shows interactions between the RP, a claimant, and a verifier/CSP. The verifi	changed here
2.4 in 2	Federation and Assertions	Normative requirements can be found in [SP800-63C] , Federation and Assertions . Section III of OMB [M-19-17] , Enabling Mission Delivery through Improved Identity, Credential, and Access Management , directs agencies to support cross-gove	changed here
2.5 in 2	Examples of Digital Identity Models	The entities and interactions that comprise the non-federated digital identity model are illustrated in Fig. 3 . The general-purpose federated digital identity model is illustrated in Fig. 4 , and a federated digital identity model with a s	changed here
2.5.1 in 2.5	Non-Federated Digital Identity Model	Figure 3 shows an example of a common sequence of interactions in the non-federated model. Other sequences could also achieve the same functional requirements. One common sequence of interactions for identity proofing and enrollment activit	changed here
2.5.2 in 2.5	Federated Digital Identity Model With General-Purpose IdP	Fig. 4. Federated Digital Identity Model Example Verifier CSP Subject RP IdP 1 2 4 3 6 Identity Proofing and Enrollment Authenticator Enrollment / Issuance Federation Request Authentication Process Authenticated Session Federation Pr	changed here
2.5.3 in 2.5	Federated Digital Identity Model with Subscriber-Controlled Wallet	Figure 5 shows an example of the interactions in a federated digital identity model in which the subscriber controls a device with software (i.e., a digital wallet) or an account with a cloud service provider (i.e., a hosted-wallet) that ac	changed here
3	Digital Identity Risk Management	This section is normative. This section describes the methodology for assessing digital identity risks associated with online services, including residual risks to users of the online service, the service provider organization, and its mis	changed here
3.1 in 3	Define the Online Service	The purpose of defining the online service is to understand its functionality and establish a common understanding of its context, which will inform subsequent steps of the DIRM process. The role of the online service is contextualized as p	changed here
3.2 in 3	Conduct Initial Impact Assessment	This step of the DIRM process addresses the first dimension of risk by identifying the risks to the online service that might be addressed by an identity system. The purpose of the initial impact assessment is to identify the potential adv	changed here
3.2.1 in 3.2	Identify Impact Categories and Potential Harms	While an online service has a discrete set of users and user groups that authenticate to access the functionality provided by the service, there may be a much larger set of entities that are impacted when imposters and attackers obtain unau	changed here
3.2.2 in 3.2	Identify Potential Impact Levels	In this step, the organization assesses the potential level of impact caused by an unauthorized user gaining access to the online service for each of the impact categories selected by the organization (from Sec. 3.2.1 ). Impact levels are a	changed here
3.2.3 in 3.2	Impact Analysis	The impact analysis considers the level of impact (i.e., Low, Moderate, or High) of compromises of any of the identity system functions (i.e., identity proofing, authentication, and federation) that results in an intruder obtaining unauthor	changed here
3.2.4 in 3.2	Determine the Combined Impact Level for Each User Group	The impact assessment levels for each user group are combined to establish a single impact level to represent the risks to impacted entities from a compromise of identity proofing, authentication, and/or federation functions for that user g	changed here
3.3 in 3	Select Initial Assurance Levels and Baseline Controls	The effective impact level (i.e., Low, Moderate, or High) serves as a primary input to the process of selecting the initial assurance level for each user group (see Sec. 3.3.1 ) to identify the corresponding set of baseline digital identity	changed here
3.3.1 in 3.3	Assurance Levels	Depending on the functionality and deployed architecture of the online service, the support of one or more of the identity management functions (i.e., identity proofing, authentication, and federation) may be required. The strength of these	changed here
3.3.2 in 3.3	Assurance Level Descriptions	A summary of each of the xALs is provided below. While high-level descriptions of the assurance levels are provided in this subsection, readers of this guideline are encouraged to refer to companion volumes [SP800-63A] , [SP800-63B] , and [	changed here
3.3.2.1 in 3.3.2	Identity Assurance Level	• IAL1: IAL1 supports the real-world existence of the claimed identity and provides some assurance that the applicant is associated with that identity. Core attributes are obtained from identity evidence or self-asserted by the applicant. A	changed here
3.3.2.2 in 3.3.2	Authentication Assurance Level	• AAL1 : AAL1 provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account. AAL1 requires either single-factor or multi-factor authentication using a wide range of available authentication te	changed here
3.3.2.3 in 3.3.2	Federation Assurance Level	• FAL1: FAL1 provides a basic level of protection for federation transactions and supports a wide range of use cases and deployment decisions. • FAL2: FAL2 provides a high level of protection for federation transactions and additional prot	changed here
3.3.3 in 3.3	Initial Assurance Level Selection	Organizations SHALL develop and document a process and governance model for selecting initial assurance levels and controls based on the potential impacts of failures in the digital identity system. The following subsections provide guidanc	changed here
3.3.3.1 in 3.3.3	Selecting Initial IAL	Before selecting an initial assurance level, RPs must determine whether identity proofing is needed for the users of their online services. Identity proofing is not required if the online service does not need any personal information to ex	changed here
3.3.3.2 in 3.3.3	Selecting Initial AAL	Authentication is needed for online services that offer access to personal information, protected information, or subscriber accounts. Organizations should consider the legal, regulatory, or policy requirements that govern online services w	changed here
3.3.3.3 in 3.3.3	Selecting Initial FAL	Identity federation brings many benefits, including a convenient customer experience that avoids redundant, costly, and often time-consuming identity processes. The benefits of federation through a general-purpose IdP model or a subscriber-	changed here
3.3.4 in 3.3	Identify Baseline Controls	The selection of the initial assurance levels for each user group and each of the applicable identity functions (i.e., IAL, AAL, and FAL) serves as the basis for selecting the baseline digital identity controls from the guidelines in compan	changed here
3.4 in 3	Tailor and Document Assurance Levels	The second dimension of risk addressed by the DIRM process focuses on risks from the identity management system that represent the unintended negative consequences of the initial selection of xALs and related technical and process controls	changed here
3.4.1 in 3.4	Assess Privacy, Customer Experience, and Threat Resistance	When selecting and tailoring assurance levels for specific online services, considerations extend beyond the initial impact assessment in Sec. 3.2 . When progressing from the initial assurance level selection in Sec. 3.3.4 to the final xAL	changed here
3.4.2 in 3.4	Identify Compensating Controls	A compensating control is a management, operational, or technical control employed by an organization in lieu of a normative control (i.e., SHALL statements) in the defined xALs. To the greatest degree practicable, a compensating control is	changed here
3.4.3 in 3.4	Identify Supplemental Controls	Supplemental controls may be added to further strengthen the baseline controls specified for the organization’s selected assurance levels. Organizations SHOULD identify and implement supplemental controls to address specific threats in the	changed here
3.4.4 in 3.4	Digital Identity Acceptance Statement	Organizations SHALL develop a Digital Identity Acceptance Statement (DIAS) to document the results of the DIRM process for (i) each online service managed by the organization, and (ii) each external online service used to support the missio	changed here
3.5 in 3	Continuously Evaluate and Improve	Continuous improvement is a critical tool for keeping pace with the threat and technology environment and identifying programmatic gaps that need to be addressed to balance risk management objectives. For instance, an organization may deter	changed here
3.5.1 in 3.5	Evaluation Inputs	To fully understand the performance of their identity system, organizations will need to identify critical inputs to their continuous evaluation process. At a minimum, these inputs SHALL include: • Integrated CSP, IdP, and authentication f	changed here
3.5.2 in 3.5	Performance Metrics	The exact metrics available to organizations will vary based on the technologies, architectures, and deployment methods they use. Additionally, the availability and usefulness of certain metrics will vary over time. Therefore, these guideli	changed here
3.5.3 in 3.5	Measurement in Support of Customer Experience Outcomes	A primary goal of continuous improvement is to enhance customer experience, usability, and accessibility outcomes for different user populations. As a result, the metrics collected by organizations SHOULD be further evaluated to provide ins	changed here
3.6 in 3	Redress	Designing services that support a wide range of populations requires processes to adjudicate issues and provide redress 4 4 Redress generally refers to a remedy that is made after harm occurs. as warranted. Service failures, disputes, and	changed here
3.7 in 3	Cybersecurity, Fraud, and Identity Program Integrity	The close coordination of identity functions with teams that are responsible for cybersecurity, privacy, threat intelligence, fraud detection, and program integrity enables a more complete protection of business capabilities and constant im	changed here
3.8 in 3	Artificial Intelligence and Machine Learning in Identity Systems	Identity solutions use artificial intelligence (AI) and machine learning (ML) in various ways, such as improving the performance of biometric matching systems, automating evidence or attribute validation, detecting fraud, and even assisting	changed here

Control tailoring. Control tailoring allows organizations to make informed risk-

based decisions to deploy technologies and processes that work for their users and adjust their baseline controls through informed decision-making to meet customer experience needs.

changed here

2

Continuous improvement programs. Establishing a continuous evaluation

program provides organizations with the ability to evaluate how well they are mitigating risks and meeting the needs of their users. Through metrics and cross- functional assessment programs, this guideline sets a foundation for a data-driv

changed here

2.1

in 2

Overview

These guidelines use digital identity models that reflect technologies and architectures that are currently available in the market. These models have a variety of entities and functions and vary in complexity. Simple models group functions

changed here

2.2

in 2

Identity Proofing and Enrollment

[SP800-63A] , Digital Identity Guidelines: Identity Proofing and Enrollment , provides general guidance information and normative requirements for the identity proofing and enrollment processes as well as IAL-specific requirements. [SP800-

changed here

2.2.1

in 2.2

Subscriber Accounts

At the time of enrollment, the CSP establishes a subscriber account to uniquely identify each subscriber and record information about the subscriber and any authenticators bound to that subscriber account. See Sec. 5 of [SP800-63A] , subsc

changed here

2.3

in 2

Authentication and Authenticator Management

[SP800-63B] , Authentication and Authenticator Management , provides normative descriptions of permitted authenticator types, their characteristics (e.g., phishing resistance), and authentication processes appropriate for each AAL. Fig. 1.

changed here

2.3.1

in 2.3

Authenticators

An authenticator is a means of demonstrating the control or possession of one or more factors in an authentication protocol. These guidelines define three types of authentication factors used for authentication: • Something you know (e.g.,

changed here

2.3.2

in 2.3

Authentication Process

The authentication process enables an RP to trust that a claimant is who they say they are to some level of assurance. The sample authentication process in Fig. 2 shows interactions between the RP, a claimant, and a verifier/CSP. The verifi

changed here

2.4

in 2

Federation and Assertions

Normative requirements can be found in [SP800-63C] , Federation and Assertions . Section III of OMB [M-19-17] , Enabling Mission Delivery through Improved Identity, Credential, and Access Management , directs agencies to support cross-gove

changed here

2.5

in 2

Examples of Digital Identity Models

The entities and interactions that comprise the non-federated digital identity model are illustrated in Fig. 3 . The general-purpose federated digital identity model is illustrated in Fig. 4 , and a federated digital identity model with a s

changed here

2.5.1

in 2.5

Non-Federated Digital Identity Model

Figure 3 shows an example of a common sequence of interactions in the non-federated model. Other sequences could also achieve the same functional requirements. One common sequence of interactions for identity proofing and enrollment activit

changed here

2.5.2

in 2.5

Federated Digital Identity Model With General-Purpose IdP

Fig. 4. Federated Digital Identity Model Example Verifier CSP Subject RP IdP 1 2 4 3 6 Identity Proofing and Enrollment Authenticator Enrollment / Issuance Federation Request Authentication Process Authenticated Session Federation Pr

changed here

2.5.3

in 2.5

Federated Digital Identity Model with Subscriber-Controlled Wallet

Figure 5 shows an example of the interactions in a federated digital identity model in which the subscriber controls a device with software (i.e., a digital wallet) or an account with a cloud service provider (i.e., a hosted-wallet) that ac

changed here

3

Digital Identity Risk Management

This section is normative. This section describes the methodology for assessing digital identity risks associated with online services, including residual risks to users of the online service, the service provider organization, and its mis

changed here

3.1

in 3

Define the Online Service

The purpose of defining the online service is to understand its functionality and establish a common understanding of its context, which will inform subsequent steps of the DIRM process. The role of the online service is contextualized as p

changed here

3.2

in 3

Conduct Initial Impact Assessment

This step of the DIRM process addresses the first dimension of risk by identifying the risks to the online service that might be addressed by an identity system. The purpose of the initial impact assessment is to identify the potential adv

changed here

3.2.1

in 3.2

Identify Impact Categories and Potential Harms

While an online service has a discrete set of users and user groups that authenticate to access the functionality provided by the service, there may be a much larger set of entities that are impacted when imposters and attackers obtain unau

changed here

3.2.2

in 3.2

Identify Potential Impact Levels

In this step, the organization assesses the potential level of impact caused by an unauthorized user gaining access to the online service for each of the impact categories selected by the organization (from Sec. 3.2.1 ). Impact levels are a

changed here

3.2.3

in 3.2

Impact Analysis

The impact analysis considers the level of impact (i.e., Low, Moderate, or High) of compromises of any of the identity system functions (i.e., identity proofing, authentication, and federation) that results in an intruder obtaining unauthor

changed here

3.2.4

in 3.2

Determine the Combined Impact Level for Each User Group

The impact assessment levels for each user group are combined to establish a single impact level to represent the risks to impacted entities from a compromise of identity proofing, authentication, and/or federation functions for that user g

changed here

3.3

in 3

Select Initial Assurance Levels and Baseline Controls

The effective impact level (i.e., Low, Moderate, or High) serves as a primary input to the process of selecting the initial assurance level for each user group (see Sec. 3.3.1 ) to identify the corresponding set of baseline digital identity

changed here

3.3.1

in 3.3

Assurance Levels

Depending on the functionality and deployed architecture of the online service, the support of one or more of the identity management functions (i.e., identity proofing, authentication, and federation) may be required. The strength of these

changed here

3.3.2

in 3.3

Assurance Level Descriptions

A summary of each of the xALs is provided below. While high-level descriptions of the assurance levels are provided in this subsection, readers of this guideline are encouraged to refer to companion volumes [SP800-63A] , [SP800-63B] , and [

changed here

3.3.2.1

in 3.3.2

Identity Assurance Level

• IAL1: IAL1 supports the real-world existence of the claimed identity and provides some assurance that the applicant is associated with that identity. Core attributes are obtained from identity evidence or self-asserted by the applicant. A

changed here

3.3.2.2

in 3.3.2

Authentication Assurance Level

• AAL1 : AAL1 provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account. AAL1 requires either single-factor or multi-factor authentication using a wide range of available authentication te

changed here

3.3.2.3

in 3.3.2

Federation Assurance Level

• FAL1: FAL1 provides a basic level of protection for federation transactions and supports a wide range of use cases and deployment decisions. • FAL2: FAL2 provides a high level of protection for federation transactions and additional prot

changed here

3.3.3

in 3.3

Initial Assurance Level Selection

Organizations SHALL develop and document a process and governance model for selecting initial assurance levels and controls based on the potential impacts of failures in the digital identity system. The following subsections provide guidanc

changed here

3.3.3.1

in 3.3.3

Selecting Initial IAL

Before selecting an initial assurance level, RPs must determine whether identity proofing is needed for the users of their online services. Identity proofing is not required if the online service does not need any personal information to ex

changed here

3.3.3.2

in 3.3.3

Selecting Initial AAL

Authentication is needed for online services that offer access to personal information, protected information, or subscriber accounts. Organizations should consider the legal, regulatory, or policy requirements that govern online services w

changed here

3.3.3.3

in 3.3.3

Selecting Initial FAL

Identity federation brings many benefits, including a convenient customer experience that avoids redundant, costly, and often time-consuming identity processes. The benefits of federation through a general-purpose IdP model or a subscriber-

changed here

3.3.4

in 3.3

Identify Baseline Controls

The selection of the initial assurance levels for each user group and each of the applicable identity functions (i.e., IAL, AAL, and FAL) serves as the basis for selecting the baseline digital identity controls from the guidelines in compan

changed here

3.4

in 3

Tailor and Document Assurance Levels

The second dimension of risk addressed by the DIRM process focuses on risks from the identity management system that represent the unintended negative consequences of the initial selection of xALs and related technical and process controls

changed here

3.4.1

in 3.4

Assess Privacy, Customer Experience, and Threat Resistance

When selecting and tailoring assurance levels for specific online services, considerations extend beyond the initial impact assessment in Sec. 3.2 . When progressing from the initial assurance level selection in Sec. 3.3.4 to the final xAL

changed here

3.4.2

in 3.4

Identify Compensating Controls

A compensating control is a management, operational, or technical control employed by an organization in lieu of a normative control (i.e., SHALL statements) in the defined xALs. To the greatest degree practicable, a compensating control is

changed here

3.4.3

in 3.4

Identify Supplemental Controls

Supplemental controls may be added to further strengthen the baseline controls specified for the organization’s selected assurance levels. Organizations SHOULD identify and implement supplemental controls to address specific threats in the

changed here

3.4.4

in 3.4

Digital Identity Acceptance Statement

Organizations SHALL develop a Digital Identity Acceptance Statement (DIAS) to document the results of the DIRM process for (i) each online service managed by the organization, and (ii) each external online service used to support the missio

changed here

3.5

in 3

Continuously Evaluate and Improve

Continuous improvement is a critical tool for keeping pace with the threat and technology environment and identifying programmatic gaps that need to be addressed to balance risk management objectives. For instance, an organization may deter

changed here

3.5.1

in 3.5

Evaluation Inputs

To fully understand the performance of their identity system, organizations will need to identify critical inputs to their continuous evaluation process. At a minimum, these inputs SHALL include: • Integrated CSP, IdP, and authentication f

changed here

3.5.2

in 3.5

Performance Metrics

The exact metrics available to organizations will vary based on the technologies, architectures, and deployment methods they use. Additionally, the availability and usefulness of certain metrics will vary over time. Therefore, these guideli

changed here

3.5.3

in 3.5

Measurement in Support of Customer Experience Outcomes

A primary goal of continuous improvement is to enhance customer experience, usability, and accessibility outcomes for different user populations. As a result, the metrics collected by organizations SHOULD be further evaluated to provide ins

changed here

3.6

in 3

Redress

Designing services that support a wide range of populations requires processes to adjudicate issues and provide redress 4 4 Redress generally refers to a remedy that is made after harm occurs. as warranted. Service failures, disputes, and

changed here

3.7

in 3

Cybersecurity, Fraud, and Identity Program Integrity

The close coordination of identity functions with teams that are responsible for cybersecurity, privacy, threat intelligence, fraud detection, and program integrity enables a more complete protection of business capabilities and constant im

changed here

3.8

in 3

Artificial Intelligence and Machine Learning in Identity Systems

Identity solutions use artificial intelligence (AI) and machine learning (ML) in various ways, such as improving the performance of biometric matching systems, automating evidence or attribute validation, detecting fraud, and even assisting

changed here