Identity assurance levelIAL

A rating of how confident you can be that an identity is genuine.

Higher levels mean the organization collected stronger evidence and checked it more rigorously before trusting that a person is who they say they are. A service picks the level that matches how much damage a fake identity could do.

A three-level scale from the US National Institute of Standards and Technology (NIST), set out in its Special Publication 800-63A, for how confidently an identity has been proofed. NIST also describes a baseline with no identity proofing, where nothing links the applicant to a specific real person. Each level builds on the one below:

• IAL1 supports the real-world existence of the claimed identity and gives some assurance that the applicant is linked to it. The identity provider collects one piece of evidence of sufficient strength, validates all core attributes (the minimum details needed for proofing, such as name and date of birth) against authoritative or credible sources, and checks that the applicant owns the evidence. It can run remotely or on-site, and biometric matching is optional. IAL1 is designed to limit automated enrollment attacks and to protect against synthetic identities.
• IAL2 requires more evidence and more rigorous validation and verification, for example two pieces of strong evidence or one piece of superior evidence. It can also run remotely or on-site, and it is designed to limit targeted attacks, basic evidence falsification, evidence theft, and social engineering.
• IAL3 adds an on-site, attended session with a trained proofing agent and the collection of at least one biometric characteristic, to guard against more sophisticated attacks.

IAL is one of three NIST scales:

• Identity assurance level (IAL) rates how well an identity was proofed.
• Authenticator assurance level (AAL) rates how strong the login method is.
• Federation assurance level (FAL) rates how securely identity data is shared between systems.