Sign in

NIST SP 800-63

NIST SP 800-63 Digital Identity Guidelines — NIST (National Institute of Standards and Technology)

Also known as: SP 800-63, NIST 800-63, Digital Identity Guidelines, 800-63B, AAL

Official site Official change log Subscribe to NIST SP 800-63 (RSS)

Current version
SP 800-63-4
Published 31 July 2025. source
Status
In force
Next deadline
None announced
Who must comply
Identity proofing, authentication and federation of users (employees, contractors or private individuals) who interact with US government information systems over networks. Nongovernmental organizations may use it voluntarily. source
How it is assessed
Each organization runs the digital identity risk management process and documents any departures. source
Written by
NIST issues the guidelines under its FISMA responsibilities, consistent with OMB Circular A-130. Federal agencies apply them alongside FISMA and the Risk Management Framework. source
Enforced by
NIST is not a regulatory agency; federal agencies implementing the guidelines must meet their statutory responsibilities, including those under FISMA. source
Last change
None recorded yet

Identity proofing, authentication and federation requirements expressed as assurance levels, used well beyond the US government as the common vocabulary for how strong an identity check has to be.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. NIST launches the Implementation Resource Hub for SP 800-63-4
  2. SP 800-63-3 withdrawn and superseded by SP 800-63-4
  3. SP 800-63-4 and volumes 63A-4, 63B-4 and 63C-4 published

Version history

  1. SP 800-63-4 Major versionCurrent

    Substantial update and reorganisation of 800-63-3. source

    More
    • It expands security, privacy and customer-experience considerations and adds a subscriber-controlled wallet federation model.
    • The digital identity risk management process now defines protected online services, user groups and impacted entities and allows tailoring of baseline controls.
    • New are performance metrics, a redress section and a section on AI and machine learning in identity services.
    • Volumes 63A-4, 63B-4 and 63C-4 were issued with it.
  2. SP 800-63-4 (2nd public draft) Draft

    Second public draft of the Revision 4 suite. source

  3. SP 800-63-4 (initial public draft) Draft

    Initial public draft of the Revision 4 suite. source

  4. SP 800-63-3 (update 2) Errata source

    Not confirmed by an official source yet.

  5. SP 800-63-3 (update 1) Errata source

    Not confirmed by an official source yet.

Show 6 older versions
  1. SP 800-63-3 Major version

    Renamed "Digital Identity Guidelines" and split into a suite: 800-63-3 plus 63A (enrollment and identity proofing), 63B (authentication) and 63C (federation). source

    More
    • It introduced separate assurance levels for identity (IAL), authentication (AAL) and federation (FAL).
    • It removed pre-registered knowledge tokens and email as an out-of-band channel and added account recovery requirements.
  2. SP 800-63-2 Revision

    Limited update of 800-63-1; substantive changes only in the registration and issuance section, to allow professional credentials in identity proofing and reduce postal mail for level 3 remote registration. source

  3. SP 800-63-1 Revision

    Reflected then-current authenticator ("token") technologies, restructured the architectural model and added minimum technical requirements for credential service providers, protocols and assertions. source

  4. SP 800-63 (update 2) Errata source

    Not confirmed by an official source yet.

  5. SP 800-63 (update 1) Errata source

    Not confirmed by an official source yet.

  6. SP 800-63 Major version

    First edition, published as the Electronic Authentication Guideline. source

Who it applies to

The guidelines cover identity proofing, enrollment, authenticators, authentication protocols, federation and assertions for people using government online services.

Scope
The guidelines cover identity proofing, enrollment, authenticators, authentication protocols, federation and assertions for people using government online services. source
Federal agencies
Federal agencies apply them on top of their FISMA obligations; the assurance levels augment, not replace, FISMA and RMF controls. source
Federation
OMB M-19-17 directs agencies to support cross-government identity federation. source
Non-federal adopters
NIST recommends that non-federal adopters follow comparable standards such as ISO/IEC 27001. source

How compliance is assessed

Each organization runs the digital identity risk management process and documents any departures.

Risk management
Each organization runs the digital identity risk management process, selects identity, authentication and federation assurance levels (IAL, AAL, FAL), tailors controls, and documents any departures in a Digital Identity Acceptance Statement. source
Risk-based
The guidelines describe themselves as risk-based rather than compliance-oriented, with performance metrics for continuous evaluation. source

Enforcement and penalties

NIST is not a regulatory agency; federal agencies implementing the guidelines must meet their statutory responsibilities, including those under FISMA.

Not a regulator
NIST is not a regulatory agency. source
Federal agencies
Federal agencies implementing these guidelines are required to meet their statutory responsibilities, including those under FISMA. source

Documents

  1. Standard NIST SP 800-63-4 – Digital Identity Guidelines (PDF)
  2. Standard NIST SP 800-63A-4 – Identity Proofing and Enrollment (PDF)
  3. Standard NIST SP 800-63B-4 – Authentication and Authenticator Management (PDF)
  4. Standard NIST SP 800-63C-4 – Federation and Assertions (PDF)
  5. Law text OMB M-19-17 – Enabling Mission Delivery through Improved Identity, Credential, and Access Management

Frequently asked questions

What is the latest version of NIST SP 800-63?

SP 800-63-4, published 31 July 2025 together with SP 800-63A-4, 63B-4 and 63C-4. It superseded SP 800-63-3, which was withdrawn on 1 August 2025. source

What changed in NIST 800-63-4?

It adds a subscriber-controlled wallet federation model and expands the digital identity risk management process. It also adds performance metrics, redress requirements and a section on AI and machine learning, with more weight on privacy and customer experience. source

What are IAL, AAL and FAL?

Identity Assurance Level, Authentication Assurance Level and Federation Assurance Level: separate levels, introduced in SP 800-63-3, for identity proofing, authentication and federation functions. source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to NIST SP 800-63 (RSS)