NIST 800-63

The US standard for digital identity assurance.

It is a set of guidelines from a US government standards agency that explains how confident an organization should be about who someone is online, and how to build identity systems that deliver that confidence.

NIST's Digital Identity Guidelines, covering three separate scales: IAL for how rigorously an identity was proofed, AAL (Authenticator Assurance Level) for how strong the login method is, and FAL (Federation Assurance Level) for how securely identity information is passed between systems. NIST is the US National Institute of Standards and Technology.

The guidelines are organized in parts:

• SP 800-63 is the overview and risk management guidance, which helps an organization choose assurance levels.
• SP 800-63A covers identity proofing and enrollment.
• SP 800-63B covers authentication and authenticator management.
• SP 800-63C covers federation and assertions.

The three scales answer different questions:

1. Identity assurance level (IAL) asks how well the person was identified when the account was created.
2. Authenticator assurance level (AAL) asks how strong the login method is at each return visit. Higher levels generally call for multi-factor and more phishing-resistant authenticators.
3. Federation assurance level (FAL) asks how securely identity data is conveyed when one system vouches for a user to another.

NIST published a major revision, SP 800-63-4, in 2025, which replaced the 2017 version. Some vendor documents still describe the earlier definitions.

The guidelines are written for US federal agencies, and many other organizations and governments use them as a reference.

NIST 800-63 sits next to terms that are easy to mix up:

• Identity assurance level (IAL) is one of the three scales.
• Identity proofing is the process that IAL grades.
• Authentication is the process that AAL grades.