NIST SP 800-63-4 NISTSP63R4-1: Digital Identity Risk Management and IAL/AAL/FAL Assurance Level Selection

Conduct Digital Identity Risk Management per NIST SP 800-63-4 Section 5 (April 2025) using the updated risk management process introduced in Rev 4. The process now explicitly considers (a) impacts to people accessing services (not only impacts to the agency), (b) equity impacts assessed alongside security and privacy impacts, (c) usability impacts on legitimate users. Select Identity Assurance Level (IAL1 + IAL2 + IAL3) per SP 800-63-4 Volume A based on consequences of identity proofing failure to the individual + the agency + third parties. Select Authenticator Assurance Level (AAL1 + AAL2 + AAL3) per SP 800-63-4 Volume B based on consequences of authentication failure. Select Federation Assurance Level (FAL1 + FAL2 + FAL3) per SP 800-63-4 Volume C based on consequences of federation failure. Document the Digital Identity Acceptance Statement with rationale + alternatives considered + equity assessment + privacy impact + ongoing monitoring plan.