NIST SP 800-63-4
Federation and Assertions

NIST SP 800-63-4 NISTSP63R4-5: Federation: Assertions, Trust Agreements, RP Validation, Pseudonymous Identifiers

Implement federation per NIST SP 800-63-4 Volume C (Federation and Assertions). Trust agreements per Section 4.3 between Credential Service Provider (CSP) + Identity Provider (IdP) + Relying Party (RP) defining responsibilities + assurance levels + assertion format + cryptographic parameters + audit obligations. Assertion protection per Section 5: bearer (FAL1) + encrypted (FAL2) + holder-of-key (FAL3) per Section 5.5 with required cryptographic algorithms + key management + nonce + expiry + audience binding. RP validation per Section 6.2: validate signature + audience + issuer + replay nonce + expiry + revocation status. Pseudonymous identifiers per Section 7.3 supporting privacy by letting RP-specific identifiers prevent cross-RP correlation by IdP. Attribute minimisation per Section 7.4. Runtime subscriber decision per Section 7.5: subscriber choice on attribute release at runtime. Federation proxies per Section 8 handling chained federation + assurance level propagation + proxy logging.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 104 controls across 46 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 5 controls

ISO/IEC 27043:2015 · 5 controls

  • ISO27043-17 Encryption of data at rest
  • ISO27043-18 Encryption of data in transit
  • ISO27043-19 Certificate management
  • ISO27043-20 Key lifecycle management
  • ISO27043-27 Network security management

ISO/SAE 21434 · 5 controls

  • ISO21434-16 Cryptographic policy and key management
  • ISO21434-17 Encryption of data at rest
  • ISO21434-18 Encryption of data in transit
  • ISO21434-19 Certificate management
  • ISO21434-27 Network security management

ASD Strategies to Mitigate Cyber Security Incidents · 4 controls

  • ASD37-17 TLS encryption between email servers (Limited)
  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-22 Network segmentation (Excellent)
  • ASD37-25 Software firewall - inbound (Very Good)

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 4 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 3 controls

  • AWWA-3.1 Network Segmentation
  • AWWA-3.2 Remote Access Security
  • AWWA-3.4 Encryption and Data Protection

FedRAMP Rev 5 · 3 controls

  • FEDRAMP-SC-13 Cryptographic Protection
  • FEDRAMP-SC-28 Protection of Information at Rest
  • FEDRAMP-SC-8 Transmission Confidentiality and Integrity

ISO/IEC 23837:2023 · 3 controls

  • 23837-1.2 Normative references
  • 23837-1.5.2 Cryptographic module requirements
  • 23837-1.5.3 Network device testing requirements

ISO/IEC 27011:2024 · 3 controls

  • 27011-6.3 Awareness and Training
  • 27011-8.2 Network security and segregation
  • 27011-8.3 Cryptography and key management

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

FFIEC IT Examination Handbook · 2 controls

  • FFIEC-06 Network security and segmentation
  • FFIEC-09 Encryption and key management

ISO 27799:2025 · 2 controls

  • ISO27799-02 ePHI encryption at rest and in transit
  • ISO27799-16 Transmission security and encryption

ISO/IEC 27010:2015 · 2 controls

  • 27010-10.1 Cryptographic Protection
  • 27010-13.1 Communications Security

NIST SP 800-190 · 2 controls

New Zealand Information Security Manual (NZISM) · 2 controls

  • NZISM-3 Personnel Security, Physical Security, and Cryptography
  • NZISM-5 Network Security, System Hardening, and Application Security

OWASP ASVS · 2 controls

OWASP MASVS · 2 controls

OWASP Top 10:2025 · 2 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 2 controls

  • IM8-CLD.2 Cloud Security Controls
  • IM8-SEC.3 Network Security

South Korea ISMS-P · 2 controls

  • ISMSP-AC-04 Network Access Control
  • ISMSP-SYS-02 Encryption Implementation

API 1164 · 1 control

  • API1164-13 Business Continuity and Recovery

APPI · 1 control

  • APPI-A34 Request for Correction, Addition or Deletion

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-D3-1 Preventative controls

FIDO2 / WebAuthn · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

IEC 62443 · 1 control

  • IEC62443-13 Network security monitoring

ISO 28001:2007 Supply Chain Security Management · 1 control

  • ISO28001-PS-01 Facility Security

ISO/IEC 27019:2024 · 1 control

  • ISO27019-13 Network security monitoring

ISO/IEC 27400:2022 · 1 control

  • 27400-6.2 Device Identity and Authentication

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework · 1 control

  • 29115-7.4 Level of Assurance 4 (LoA4)

NATO STANAG 4774 (Confidentiality Metadata Labels) and STANAG 4778 (Metadata Binding) · 1 control

  • STANAG-2 STANAG 4778 Metadata Binding Mechanism and Cryptographic Binding

NIST Privacy Framework · 1 control

  • NISTPF-5 Protect-P Access Control (PR.AC-P)

NIST SP 1800-32 · 1 control

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

New Jersey Data Privacy Act · 1 control

  • NJDPA-7 Data Protection Assessments and Processor Contracts

Nigeria Open Banking Regulatory Framework (CBN, 2023) · 1 control

  • NGOB-3 API Security Standards, mTLS, and Encryption

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-6 Security Misconfiguration and Secure API Design

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

Turkey KVKK · 1 control

  • TURKEYKVKK-2 Information Notice and Data Subject Rights

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-CS.1 Network Security for Connected Products

US EPA Safe Drinking Water Act (SDWA) - Cybersecurity Requirements · 1 control

  • USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 104 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-63-4 controls