IAL1 identifies an individual's real world identity with high degrees of certainty that claimed identity matches up with that of the authenticator.

While the core structure of IAL, AAL and FAL remains unchanged, their requirements have been updated to respond to emerging threats. Email one-time passwords have been officially deprecated while SMS-based authentication has seen significant reductions.

Authentication

NIST SP 800-63-3's recent update highlights the importance of extensive identity proofing and robust phishing-resistant authentication, with SMS-based MFA being downgraded and strongly promoted as the new baseline FIDO Passkeys being seen as preferred. Furthermore, subscriber-controlled wallets as well as verifiable credentials were integrated into its federated identity model formally.

IAL3 requires an on-site, attended identity proofing session where an applicant provides multiple forms of physical evidence that is verified by an identity proofing agent, in addition to fulfilling remote IAL2 requirements. Once successful at on-site identity proofing, CSP enrolls the individual into their subscriber account with one or more authenticators tied directly to their proven identity within that account.

NIST IAL3 verification solutions are essential to anyone who requires access to FedRAMP High environments. A dependable and robust verification solution ensures compliance with NIST SP 800-63-3 while simultaneously decreasing cyber liability by creating an extremely resilient authentication system and strengthening security and reducing attack surfaces by decreasing password recollection requirements for users.

Proof of Identity

NIST 800-63A IAL3 Identity Proofing and Authentication Guidelines are indispensable for modern digital identities, providing extensive identity proofing, phishing-resistant multifactor authentication (MFA), and secure federated identification practices.

CSPs must follow a three-step process in order to identify an applicant and validate their real world identity with an assured level. IAL3 compliant solution involves collecting relevant identity evidence and attribute details.

Identity validation involves verifying that an applicant is who they claim they are, such as by comparing digital images of ID documents against original physical copies or using video-based face recognition with liveness detection technology. NIST also specifies certain assurance levels known as Federation Authentication Levels or FALs - AAL3 being reserved for the highest security needs such as cryptographic device-bound passkeys like FIDO security keys and subscriber controlled wallets.

Reliability

NIST Special Publication 800-63 is an essential guideline for identity verification ecosystem. It details how organizations verify identities, authenticate users, and securely exchange identity data. However, its framework of assurance levels can seem complex and daunting for those outside of identity industry.

Modern technology provides solutions that simplify NIST 800-63 compliance and help reconcile business and security objectives. Trust Swiftly's IAL3 solution validates multiple identity attributes using chat, video, facial recognition with liveness detection, document authentication and document verification - including support for step-up reproofing according to risk, so an individual's identity remains valid well past an initial check. Get detailed information on NIST IAL3 verification by clicking here or visiting our site.

Selecting the ideal assurance level for your needs starts by understanding your business risks. This enables you to strike a balance between feasibility, risk reduction and certification availability.

Security

NIST 800-63A IAL3 is an identity management framework for online authentication. It defines levels of IAL3 identity proofing, authentication and federation assurance to allow adaptive risk management as well as providing a comprehensive digital identity lifecycle to ensure secure yet user-friendly experiences.

The fourth version of NIST guidelines retains its tripartite structure of Identity Access Layers (IAL), Authorization Access Levels (AAL), and False Acceptance Layers (FAL), while updating requirements to better respond to changing threats and new technologies. For instance, this version prioritizes phishing-resistant authentication mechanisms and supports remote, unattended identity proofing processes formally.

NIST now explicitly authorizes CSPs to offer multiple pathways for IAL2 verification and record which pathway was taken by each subscriber. This is important, as RPs need to know what level of assurance they are receiving in order to make informed decisions about access control and privacy risks. A CSP should only send attribute data that helps meet risk tolerance thresholds; furthermore they should limit personal data sent over by only sending out a boolean value or reference instead of full attribute values to avoid sending personal data across.