NIST SP 800-63

Digital Identity Guidelines - IAL/AAL/FAL identity assurance levels, phishing-resistant MFA.


Short name	800-63
Region	Americas
Country or scope	United States
Sector	Government
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers 800-63

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for 800-63.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for 800-63 and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`SP80063A-UID` Unique, Resolvable Identity	Identity proofing requires resolving a claimed identity to a single, unique subject before it can be verified; by analogy the components of the identity system itself must each carry a unique standard identifier (SP 800-63A, identity resolution and enrollment requirements)	Scan
`SP80063A-COMPLETE` Complete Identity Evidence Records	Identity evidence must be collected and validated with enough attributes to distinguish the subject; applied to the identity infrastructure, every component record needs both a name and a version to be distinguishable (SP 800-63A, evidence collection and validation requirements)	Scan
`SP80063B-INTG` Authenticator and Verifier Integrity	Authentication at higher assurance levels depends on verifiers and authenticators resisting compromise and tampering, which requires cryptographic integrity verification of the software implementing them (SP 800-63B, authenticator and verifier requirements)	Scan
`SP80063C-PROV` Assertion Provenance	Federation requires relying parties to trust assertions based on who issued them and how they were protected, making recorded creator provenance essential for artifacts in the identity chain (SP 800-63C, assertion and federation requirements)	Scan
`SP80063B-VULN` Maintained, Unexpired Authentication Stack	Authenticator assurance depends on the verifier software staying current against known attacks such as phishing and replay; determining exposure requires the exact version of each component in the authentication stack (SP 800-63B, verifier compromise resistance requirements)	Scan
`SP80063-RECORDS` Enrollment and Lifecycle Records	CSPs must maintain records of enrollment, proofing, and authenticator lifecycle events for auditability, which is supported by formally identified, timestamped machine-readable documentation of the identity systems (SP 800-63A/B recordkeeping requirements)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`63-IAL1`	Identity Assurance Level 1
`63-IAL2`	Identity Assurance Level 2
`63-IAL3`	Identity Assurance Level 3
`63-AAL1`	Authenticator Assurance Level 1
`63-AAL2`	Authenticator Assurance Level 2
`63-AAL3`	Authenticator Assurance Level 3
`63-FAL1`	Federation Assurance Level 1
`63-FAL2`	Federation Assurance Level 2
`63-FAL3`	Federation Assurance Level 3
`63-SEC4`	Identity Proofing Requirements
`63-SEC5`	Authenticator Lifecycle Management
`63-SEC6`	Federation & Assertions

Policy templates

Written for 800-63:

NIST 800-63 Identity Proofing & Authenticator Policy

And 22 from the standard set, adapted to 800-63.