NIST PIV and digital identity SP 800-63A → SP 800-63A-4
Published 2025-07-31
Snapshot taken 2026-10-19 23:50 · sp-800-63a source
Snapshot taken 2026-10-19 23:50 · sp-800-63a source
+ 19 added: 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 6.1, 6.2, 7.1.1, 7.2…
− 13 removed: 10, 10.1, 10.2, 10.3, 8.3, 8.4, 8.5, 8.6, 9, 9.1…
~ 12 revised: 1, 2, 3, 4, 5, 6, 7, 7.1, 8, 8.1…
Why this release, in the publisher's words
Planning Note (10/06/2026): The Implementation Resource Hub for SP 800-63-4 is now available!
https://csrc.nist.gov/pubs/sp/800/63/a/4/finalAll · 441 The CSP SHALL monitor the entire identity proofing session through a high- · 110 References · 42 The CSP SHALL have a live proofing agent participate remotely with the applicant · 13 The CSP SHALL require all actions taken by the applicant during the evidence · 14 The CSP SHALL require that all digital validation and verification of evidence · 15 Subscriber Accounts · 76 Threats and Security Considerations · 37 Privacy Considerations · 88 Customer Experience Considerations · 98 Privacy Considerations · 49 Usability Considerations · 5
Controls added, removed or revised 44
| Control | Title | Change |
|---|---|---|
| 1 | The CSP SHALL monitor the entire identity proofing session through a high- | Control text, Title |
| 10 | References | removed |
| 10.1 | General References | removed |
| 10.2 | Standards | removed |
| 10.3 | NIST Special Publications | removed |
| 2 | The CSP SHALL have a live proofing agent participate remotely with the applicant | Control text, Title |
| 3 | The CSP SHALL require all actions taken by the applicant during the evidence | Control text, Title |
| 4 | The CSP SHALL require that all digital validation and verification of evidence | Control text, Title |
| 5 | Subscriber Accounts | Control text, Title |
| 5.1 | Subscriber Accounts | added |
| 5.2 | Subscriber Account Access | added |
| 5.3 | Subscriber Account Maintenance and Updates | added |
| 5.4 | Subscriber Account Suspension or Termination | added |
| 5.5 | Data Breach Notification | added |
| 5.6 | Multiple Subscriber Account Scenarios | added |
| 6 | Threats and Security Considerations | Control text, Title |
| 6.1 | Threat Mitigation Strategies | added |
| 6.2 | Collaboration With Adjacent Programs | added |
| 7 | Privacy Considerations | Control text, Title |
| 7.1 | Collection and Data Minimization | Control text, Title |
| 7.1.1 | Social Security Numbers | added |
| 7.2 | Notice and Consent | added |
| 7.3 | Use Limitation | added |
| 7.4 | Redress | added |
| 7.5 | Privacy Risk Assessment | added |
| 7.6 | Agency-Specific Privacy Compliance | added |
| 8 | Customer Experience Considerations | Control text, Title |
| 8.1 | Usability | Control text, Title |
| 8.1.1 | General User Considerations During Identity Proofing and Enrollment | Control text, Title |
| 8.1.2 | Preparation | added |
| 8.1.3 | Identity Proofing and Enrollment | added |
| 8.1.4 | Post-Enrollment | added |
| 8.2 | Customer Success Considerations | Control text, Title |
| 8.2.1 | Support Multiple Types of Identity Proofing | added |
| 8.2.2 | Partner With Multiple Credible and Authoritative Sources | added |
| 8.3 | Processing Limitation | removed |
| 8.4 | Redress | removed |
| 8.5 | Privacy Risk Assessment | removed |
| 8.6 | Agency Specific Privacy Compliance | removed |
| 9 | Usability Considerations | removed |
| 9.1 | General User Experience Considerations During Enrollment and Identity Proofing | removed |
| 9.2 | Pre-Enrollment Preparation | removed |
| 9.3 | Enrollment Proofing Session | removed |
| 9.4 | Post-Enrollment | removed |
Read every requirement in this version · All versions of NIST PIV and digital identity