Identity verification levels defined by NIST?
Daniel Álvarez García
+11 years at PwC | Creator of The Lead Identity, an exclusive community for building a future in Cybersecurity and Digital Identity
Do you know it?
The Identity Assurance Levels (IAL) in the NIST SP 800-63A framework are essential for determining the rigor and accuracy of identity verification processes within digital systems.
Never heard of it?
Well, it’s one of the best guides to understand the core processes of digital identity.
Here’s a quick summary. There are three identity assurance levels:
IAL1: Unverified Identity
Characteristics:
The identity is not verified.
This level doesn’t require any documentary or complex evidence to validate a user’s identity.
Temporary identifiers or aliases can be used to access services.
Common use cases:
Services that don’t require access to sensitive information, such as general discussion forums or online news content.
Information platforms where users can interact without needing to know or verify each other’s identity.
Forums, open info platforms, anything where anonymity is acceptable.
Risks and Mitigations:
Although access doesn’t require identity verification, platforms must still ensure general security to avoid abuse or fraud.
Activity monitoring may be important to detect unusual behavior that could signal an attempt to compromise the system.
No verification = fertile ground for bots, fake profiles and fraud.
IAL2: Verified Identity
Characteristics:
This level requires evidence of identity validated by a trusted authority.
Information may include documents such as passports, driver’s licenses, or other official documents.
Remote validation is allowed, but it still demands a thorough process to ensure document legitimacy.
Verification Methods:
Documentation: Submission and verification of identity documents issued by an official authority.
Optional Biometric Validation: Some organizations may choose to include biometric data (like fingerprints) as part of the process, even if not strictly required.
Data Comparison: Using trusted databases to validate personal information, such as cross-checking with credit bureaus.
Common use cases:
Registration and access to platforms handling personal data—like email accounts, online banking, or medical records.
Employment processes and background checks that require confirmation of personal details.
Perfect for online banking, job applications, healthcare records.
Trust Framework:
Organizations must define clear and trustworthy criteria to accept identity documents, assessing authenticity, validity, and relevance.
But here’s the catch:
Most companies think they’re doing IAL2 well… but they’re not.
IAL3: In-Person Verified Identity
Characteristics:
The highest level of verification, requiring the individual to be physically present during validation.
Strong documents like passports, military IDs, or biometric access (e.g., facial recognition, iris scan) are used.
Verification Methods:
In-Person Evaluation: Verified in front of an authorized representative who checks the documents and biometric traits.
Advanced Biometrics: Use of technologies such as fingerprint, facial recognition, and iris scanning to ensure identity.
Multi-Factor Authentication: Involving something the user knows (like a password), something they have (a physical token), and something they are (biometric data).
Common use cases:
Access to restricted high-security environments like government or military facilities.
Protection of extremely sensitive data, like classified research or high-stakes corporate information.
Data Protection:
Strict privacy policies are required to safeguard biometric and personal data. Advanced security must be in place to prevent identity theft and data manipulation.
Only a few orgs reach this level.
But the threats of deepfakes and synthetic identities are growing. Fast.
Conclusion: Identity Assurance Is Just One Piece of the Puzzle
Understanding IALs is a critical step toward securing your digital ecosystem.
But it doesn’t end there.
The NIST SP 800-63 framework is composed of three complementary parts:
SP 800-63A – Identity Assurance (IAL): Verifying who the user claims to be.
SP 800-63B – Authentication Assurance (AAL): Ensuring the right person is accessing the system, using strong authentication methods (like MFA, hardware tokens, biometrics).
SP 800-63C – Federation Assurance (FAL): Governing how identity and authentication data is shared across systems and organizations.
If you’re only focusing on identity verification (IAL) and ignoring authentication (AAL) or federation (FAL), you’re building trust on a weak foundation.
Digital Identity is not just about checking a document—it’s about building an end-to-end trust model.
In a world of synthetic identities, AI-driven fraud, and increasing interoperability…