Skip to main content    

An official website of the United States government

Here’s how you know

**Official websites use .gov**              A **.gov** website belongs to an official government organization in the United States.            

**Secure .gov websites use HTTPS**              A **lock** (  LockA locked padlock) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.            

https://www.nist.gov/special-publication-800-63

            -  Topics  -  All Topics 
-  Advanced communications 
-  Artificial intelligence 
-  Bioscience 
-  Buildings and construction 
-  Chemistry 
-  Climate 
-  Cybersecurity 
-  Electronics 
-  Energy 
-  Environment 
-  Fire 
-  Forensic science 
-  Health 
-  Information technology 
-  Infrastructure 
-  Manufacturing 
-  Materials 
-  Mathematics and statistics 
-  Metrology 
-  Nanotechnology 
-  Neutron research 
-  Performance excellence 
-  Physics 
-  Public safety 
-  Resilience 
-  Standards 
-  Transportation 
 
            -  Publications 
            -  Labs & Major Programs  -  Laboratories    -  Communications Technology Laboratory 
  -  Engineering Laboratory 
  -  Information Technology Laboratory 
  -  Material Measurement Laboratory 
  -  Physical Measurement Laboratory 
-  User Facilities    -  NIST Center for Neutron Research 
  -  CNST NanoFab 
-  Research Test Beds 
-  Research Projects 
-  Tools & Instruments 
-  Major Programs    -  Baldrige Performance Excellence Program 
  -  CHIPS for America Initiative 
  -  Manufacturing Extension Partnership (MEP) 
  -  Office of Advanced Manufacturing 
  -  Special Programs Office 
  -  Technology Partnerships Office 
 
            -  Services & Resources  -  Standards and Measurements    -  Calibration Services 
  -  Laboratory Accreditation (NVLAP) 
  -  Quality System 
  -  Standard Reference Materials (SRMs) 
  -  Standards.gov 
  -  Time Services 
  -  Office of Weights and Measures 
-  Software 
-  Data    -  Chemistry WebBook 
  -  National Vulnerability Database 
  -  Physical Reference Data 
  -  Standard Reference Data (SRD) 
-  Storefront 
-  License & Patents 
-  Computer Security Resource Center (CSRC) 
-  NIST Research Library 
 
            -  News & Events  -  News 
-  Events 
-  Blogs 
-  Feature Stories 
-  Awards 
-  Video Gallery 
-  Image Gallery 
-  Media Contacts 
 
            -  About NIST  -  About Us    -  Leadership 
  -  Organization Structure 
  -  Budget & Planning 
-  Contact Us 
-  Visit 
-  Careers    -  Student programs 
-  Work with NIST 
-  History    -  NIST Digital Archives 
  -  NIST Museum 
  -  NIST and the Nobel 
-  Educational Resources 
 

Information Technology Laboratory

## Applied Cybersecurity Division

-  Projects/Programs  Expand or Collapse    -  Cybersecurity and Privacy Applications 
  -  Cybersecurity for the Internet of Things (IoT) 
  -  Cybersecurity Framework 
  -  National Cybersecurity Center of Excellence (NCCoE) 
  -  National Initiative for Cybersecurity Education (NICE) 
  -  Privacy Framework 
  -  Small Business Cybersecurity Corner 
-  How to Work With Us 
-  NIST Publications Searchable Database 
-  Staff Directory 
-  News & Updates 
-  Events 

# Special Publication 800-63

## Share

Facebook

Linkedin

Twitter

Email

This page is ARCHIVED. Please visit https://www.nist.gov/identity-access-management for current information on NIST’s Identity and Access Management work.

## **Read NIST’s Digital Identity Guidelines!**

More than a year in the making, and after a large, cross-industry effort, NIST is proud to announce the new SP 800-63.

GitHub

## **The basics**

The Special Publication (SP) 800-63 suite provides technical requirements for federal agencies implementing digital identity services. The publication includes: an overview of identity frameworks; using authenticators, credentials, and assertions in a digital system; and a risk-based process to select assurance levels. Organizations have the flexibility to choose the appropriate assurance level for their needs.

SP 800-63 comprises a suite of documents that can be used independently or in concert to meet identity needs.

## **The suite**

**SP 800-63-3: Digital Identity Guidelines**GitHub | PDF

**SP 800-63A: Enrollment & Identity Proofing**GitHub | PDF

**SP 800-63B: Authentication & Lifecycle Management**GitHub | PDF

**SP 800-63C: Federation & Assertions**GitHub | PDF

## **Changes to 800-63 since the last version**

For the new SP 800-63, NIST sought to simplify and clarify guidance, better align with commercial markets, promote international interoperability, and focus on outcomes (where possible) to promote innovation and deployment flexibility. Furthermore, the updates in this publication give relying parties latitude in designing, building, consuming, and procuring identity technology.

Highlights:
                  - Broke down level of assurance into its independent parts: identity proofing, authenticators, and federated assertions
                  - Created multiple volumes with clear distinctions between normative and informative language, so each volume is a one-stop shop for mandatory requirements and recommended approaches
                  - Gave identity proofing a major overhaul, with support from UK and Canadian peers; guidance supports in-person proofing over a virtual channel, though under a strict set of requirements
                  - Clarified that knowledge-based verification is limited to specific portions of the identity proofing process and never sufficient on its own
                  - Placed additional restrictions on the use of SMS for a one-time password (OTP) and removed OTP via email
                  - Addressed the security required for centralized biometric matching
                  - Updated terminology to clarify language across the identity space

## **Approach**

NIST has co-developed SP 800-63-3 with the community (feedback was solicited via GitHub and dig-comments [at] nist.gov (email))  to ensure that it helps organizations implement effective digital identity services, reflects available technologies in the market, and makes room for innovations on the horizon. GitHub has enabled NIST to engage the community in near-real-time to more efficiently create a better product. The SP 800-63 update process included multiple iterations and opportunities for stakeholders to weigh in on the document.

Before NIST released SP 800-63 as final, community participation in drafting the publication resulted in 1,400+ comments—and the web version of the publication drew 74,000+ unique visitors between May 2016 and May 2017.

## Looking forward

#### Implementation guidance

NIST will work with the community to prepare implementation guidance for the *Digital Identity Guidelines*. The goal is to give implementers easily deployable guidance and help them meet the requirements.

#### SP 800-63D

NIST is drafting SP 800-63D, a relatively simple additional volume detailing efforts to align with international technical specifications for interoperable identity in federations—including SAML profiles and an iGov OpenID Connect/OAuth profile developed in partnership with industry and other governments.

## Timeline

**June 2017**| SP 800-63-3 published | more

**May 2017** | Draft SP 800-63-3 public comment closes

**February 2017** | Draft SP 800-63-3 public draft webinar held | video | slides

**January 2017** | Draft SP 800-63-3 released for public comment  | more

**September 2016** | Draft SP 800-63-3 public preview closes | more

**May 2016** | Draft SP 800-63-3 released for public preview | more

**May 2015** | Public comment on SP 800-63-2 closes | more

**April 2015** | Public comment on SP 800-63-2 opens  | more

**August 2013** | SP 800-63-2 published | PDF

**December 2011** | SP 800-63-1 published | PDF

**April 2006** | SP 800-63 version 1.0.2 published | PDF

**September 2004**| SP 800-63 version 1.0.1 published

**June 2004**| SP 800-63 first published

## **Learn more**

                  - FAQs |  GitHub
                  - Public draft informational webinar |  video  |  slides
                  -  Source information, current standards, and public comments received through May 2015 | more 

## **Related blog posts**

                  -  Return of the Great Zoltan! Our 800-63 FAQs answer life’s most perplexing questions (about digital identity, anyway). | July 2017 | more 
                  -  Mic Drop — Announcing the New Special Publication 800-63 Suite! | June 2017 | more 
                  -  A minor plot twist: comment period extended for part of SP 800-63-3 | March 2017 | more 
                  - Public comment period announcement | January 2017 |  more
                  - Thank you for a successful public preview | September 2016 |  more
                  - Public preview announcement | May 2016 |  more

### HEADQUARTERS

301-975-2000

Webmaster | Contact Us | Our Other Offices

TwitterFacebookLinkedInInstagramYouTubeGiphyRSS FeedMailing List

Feedback

            -  Site Privacy 
            -  Accessibility 
            -  Privacy Program 
            -  Copyrights 
            -  Vulnerability Disclosure 
            -  No Fear Act Policy 
            -  FOIA 
            -  Environmental Policy 
            -  Scientific Integrity 
            -  Information Quality Standards 
            -  Commerce.gov 
            -  Science.gov 
            -  USA.gov 
            -  Vote.gov