NIST SP 800-63-4 1: Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection
Conduct Digital Identity Risk Management per NIST SP 800-63-4 Section 5 (April 2025) using the updated risk management process introduced in Rev 4. The process now explicitly considers (a) impacts to people accessing services (not only impacts to the agency), (b) equity impacts assessed alongside security and privacy impacts, (c) usability impacts on legitimate users. Select Identity Assurance Level (IAL1 + IAL2 + IAL3) per SP 800-63-4 Volume A based on consequences of identity proofing failure to the individual + the agency + third parties. Select Authenticator Assurance Level (AAL1 + AAL2 + AAL3) per SP 800-63-4 Volume B based on consequences of authentication failure. Select Federation Assurance Level (FAL1 + FAL2 + FAL3) per SP 800-63-4 Volume C based on consequences of federation failure. Document the Digital Identity Acceptance Statement with rationale + alternatives considered + equity assessment + privacy impact + ongoing monitoring plan.
What else in your programme already covers this
This control maps to 185 controls across 99 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,