NIST 800-63A IAL3 guidance offers a measuring stick to compare the security of various digital identity approaches, though its defined assurance levels often conflict in practice.

IAL1 doesn’t involve mapping claimed attributes to real identities or verifying they belong to the claimant, while IAL3 requires physical presence (including remote supervision) and biometric comparison of evidence that supports your claim.

Authentication

NIST IAL3 verification encompasses in-person identity proofing (or remote supervised identity proofing), biometric comparison with the strongest piece of ID, document validation against authoritative sources and attributes, biometric linking with strong identification documents to reduce impersonation and fraud, SIM swaps or MFA bypass by linking biometrics securely and protecting against SIM swapping/MFA bypass.

NIST 800-63A IAL3 outlines three categories of assurance levels, Identity Assurance Level (IAL), Authentication Assurance Level (AAL), and Federation Assurance Level (FAL), to enable organizations to use risk-based Digital Identity Risk Management (DIRM) to determine an appropriate assurance level at each step along a user’s secure journey.

AALs don’t have to match, with lighter identity proofing (IAL1) pairing well with stronger authentication (AAL3). Indeed, often IAL2 and AAL3 serve as practical “sweet spots” due to feasibility, risk reduction and certification availability – TrustSwiftly is a IAL3 compliant solution with both standards – offering chat, video and facial recognition with liveness detection to lower cyber liability insurance costs as well as operational expenses like password resets.

Document Verification

NIST 800-63A IAL3, in its fourth version, maintains the three-part model of Identity Access Layer, Authorization Access Layer and Fraud Alert Layer while updating requirements to reflect modern identity technologies such as biometrics, user-controlled wallets and advanced authentication methods. Furthermore, this document changes from being checklist based to using risk-based Digital Identity Risk Management (DIRM) framework for management purposes.

CSPs who wish to meet IAL3 standards must conduct an in-person verification session with applicants to compare their claimed identities against real identities provided via documents or video of live people. This step-up in verification standards helps organizations reduce attack surface by restricting attackers from exploiting false or compromised attributes and credentials.

CSPs must also give applicants the option of re-establishing authenticator binding to their enrollment record by means of an enrollment code, and verifying trusted referee identities up to an IAL3 assurance level for increased robustness of federation models, protecting against spoofing attacks and fraud.

Biometric Comparisons

At the highest level of identity assurance (IAL3), physical presence must be present, either physically in-person or remotely supervised. A live biometric comparison between applicant’s biometrics and the strongest piece of evidence allows us to verify whether that individual is indeed the subject. As this method can be more expensive than others used for verification, IAL3 verification should only be considered when security access to buildings or financial accounts are at stake.

CSPs face an uphill task when reviewing applicants, which requires hiring an independent referee who must examine each one individually, which can be prohibitively expensive. To reduce costs, CSPs can utilize the KBV method, which involves comparing enrollee responses to challenge questions against information provided in their documents – though this approach could still be subject to fraud via socially engineered fakes; to mitigate against this it is advised to employ biometric comparison methods (FAIR or otherwise). Below is a table presenting detailed requirements for each method in question –

Liveness Detection

NIST’s latest revision places special emphasis on authentication methods and particularly deprecates email one-time passwords (OTP) and SMS-based authentication as these have proven vulnerable to widespread phishing attacks and are no longer appropriate in higher assurance scenarios. Furthermore, NIST strongly promotes multifactor authentication (MFA), with FIDO Passkeys acting as the gold standard of authentication.

TrustSwiftly identity verification and authentication platform provides high assurance results while being cost effective and minimally disruptive for users. It addresses NIST SP 800-63-3 requirements directly while being user friendly in terms of cost reduction and disruption. TrustSwiftly remote but supervised IAL3 identity proofing process integrates chat, video, document verification, facial recognition with liveness detection, step-up reproofing based on risk levels to provide continuous identity assurance that exceeds NIST compliance levels IAL2 and IAL3.

Organizations using this system can mitigate business and security risks such as reduced cyber liability insurance costs, operational savings from reduced password resets, and minimized attack surfaces for phishing attacks or man-in-the-middle attacks. Furthermore, users can authenticate using their own device which further minimizes attack surfaces.