Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/identity-access-management/roadmap-nist-special-publication-800-63-4-digital-identity-guidelines

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information TechnologyCybersecurity

## Identity & access management

-  Projects  Expand or Collapse    -  NIST Special Publication 800-63 Digital Identity Guidelines 
  -  Personal Identity Verification (PIV) 
  -  Biometrics at NIST 
  -  NCCOE Identity and Access Management 
  -  Control Policy Test Technologies (ACPT and ACRLCS) 
  -  EU-US TTC Digital Identity Mapping Exercise Report 
  -  Policy Machine and Next Generation Access Control 
-  Roadmap  Expand or Collapse    -  NIST Special Publication 800-63-3 Digital Identity Guidelines 
  -  FIPS 201 Personal Identity Verification (PIV) 
  -  NCCOE Identity Projects 
-  Newsroom 

# Roadmap: NIST Special Publication 800-63-4 Digital Identity Guidelines

## Share

Facebook

Linkedin

Twitter

Email

## **Special Publication 800-63, Draft Revision 4**

The Draft Fourth Revision of NIST SP 800-63, *Digital Identity Guidelines* is available for review, and we need your feedback! NIST will accept all input submitted until **11:59pm on April 14, 2023,**through the following site: https://csrc.nist.gov/publications/detail/sp/800-63/4/draft.

NIST held a virtual event, Digital Identity Guidelines – Kicking off Revision 4!, on January 12, 2023. Presentation slides are available here.

### **Background**

The rapid proliferation of online services over the past few years has heightened the need for reliable, equitable, secure, and privacy-protective digital identity solutions.

Revision 4 of NIST Special Publication 800-63, Digital Identity Guidelines, intends to respond to the changing digital landscape that has emerged since the last major revision of this suite was published in 2017 — including the real-world implications of online risks. The guidelines present the process and technical requirements for meeting digital identity management assurance levels for identity proofing, authentication, and federation, including requirements for security and privacy as well as considerations for fostering equity and the usability of digital identity solutions and technology.

Taking into account feedback provided in response to our June 2020 Pre-Draft Call for Comments, as well as research conducted into real-world implementations of the guidelines, market innovation, and the current threat environment, this draft seeks to:
                  - Advance Equity:  This draft seeks to expand upon the risk management content of previous revisions and specifically mandates that agencies account for impacts to individuals and communities in addition to impacts to the organization. It also elevates risks to mission delivery – including challenges to providing services to all people who are eligible for and entitled to them – within the risk management process and when implementing digital identity systems. Additionally, the guidance now mandates continuous evaluation of potential impacts across demographics, provides biometric performance requirements, and additional parameters for the responsible use of biometric-based technologies, such as those that utilize face recognition.
                  - Emphasize Optionality and Choice for Consumers:  In the interest of promoting and investigating additional scalable, equitable, and convenient identify verification options, including those that do and do not leverage face recognition technologies, this draft expands the list of acceptable identity proofing alternatives to provide new mechanisms to securely deliver services to individuals with differing means, motivations, and backgrounds. The revision also emphasizes the need for digital identity services to support multiple authenticator options to address diverse consumer needs and secure account recovery.
                  - Deter Fraud and Advanced Threats:  This draft enhances fraud prevention measures from the third revision by updating risk and threat models to account for new attacks, providing new options for phishing resistant authentication, and introducing requirements to prevent automated attacks against enrollment processes. It also opens the door to new technology such as mobile driver’s licenses and verifiable credentials.
                  - Address Implementation Lessons Learned:  This draft addresses areas where implementation experience has indicated that additional clarity or detail was required to effectively operationalize the guidelines. This includes re-working the federation assurance levels, providing greater detail on Trusted Referees, clarifying guidelines on identity attribute validation sources, and improving address confirmation requirements.

### Roadmap

## **SP 800-63-3 Implementation Resources**

NIST Special Publication 800-63-3, *Digital Identity Guidelines*, is an umbrella publication that introduces the digital identity model described in the SP 800-63-3 document suite. It frames identity guidelines in three major areas:
                  - Enrollment and identity proofing (SP 800-63A),
                  - Authentication and lifecycle management (SP 800-63B),
                  - Federation and assertions (SP 800-63C).

 In addition to introducing detailed guidelines in these areas, SP 800-63-3 addresses the factors involved in choosing the appropriate Identity Assurance Level (IAL), Authentication Assurance Level (AAL), and Federation Assurance Level (FAL) for a given application.

These implementation resources are provided pursuant to OMB Policy Memorandum M-19-17. While these resources reference normative guidelines in the SP 800-63-3 document suite and other documents, these resources are intended as informative implementation guidance and are not normative. These implementation resources provide guidance for SP 800-63-3 in three parts: Part A addresses SP 800-63A, Part B addresses SP 800-63B, and Part C addresses SP 800-63C.

Comments on these resources are welcomed and can be submitted via email to dig-comments [at] nist.gov (dig-comments[at]nist[dot]gov).

## **SP 800-63-3 Conformance Criteria**

Pursuant to Office of Management and Budget Policy Memorandum M-19-17, the Conformance Criteria present non-normative, informational guidance on all requirements and controls contained in NIST Special Publications (SP) 800-63A*Enrollment and Identity Proofing* and SP 800-63B*Authentication and Lifecycle Management* for assurance levels IAL2 and IAL3 and AAL2 and AAL3. The complete set of Conformance Criteria are intended to provide non-normative supplemental guidance to federal agencies and other organizations to facilitate implementation and assessment.

Comments or questions on the Conformance Criteria may be sent to dig-comments [at] nist.gov (dig-comments[at]nist[dot]gov).

Information technologyCybersecurityIdentity and access management

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov