NIST Special Publication 800-63A

These guidelines provide technical requirements for federal agencies implementing digital identity services and are not intended to constrain the development or use of standards outside of this purpose. This guideline focuses on the enrollment and verification of an identity for use in digital authentication. Central to this is a process known as identity proofing in which an applicant provides evidence to a credential service provider (CSP) reliably identifying themselves, thereby allowing the CSP to assert that identification at a useful identity assurance level. This document defines the technical requirements for each of the three identity assurance levels. This publication supersedes corresponding sections of NIST Special Publication (SP) 800-63-2.

Modules include:

NIST Special Publication 800-63A

NIST 800-63A Compliance Requirements

NIST SP 800-63A compliance is a documenting centred around the identity proofing process and the reliability of a digital identity. There are three levels of identity assurance, the first being very basic with no hard proof required. The second level requires identifying materials used for remote or in-person identity proofing. The third and highest level of identity evidence is in-person using physical biometric proofing for the greatest assurance.

NIST SP 800-63A offers a digital identities guideline with appropriate levels of identity evidence. In short, it’s a framework for ensuring reliable, secure online interactions for digital identities.

Audit & Assessment Services with NIST 800-63A

The audit and assessment process begins with an overall risk assessment as to how the organization handles digital identities. The identity proofing process and authentication methods are reviewed.

The organization’s way of sharing information between different systems is assessed, as well as the security controls for protecting sensitive data. Finally, the organization is audited for how their policies and procedures align with NIST SP 800-63A requirements.

Undergoing an audit and assessment helps with the organization’s cybersecurity posture, builds trust among customers, and ensures you’re in compliance with these regulations around the identity proofing process.

FAQ

What does NIST SP 800-63A cover?

This document defines the digital identity guidelines needed to ensure that digital interactions are accurate, safe, and protected. It outlines the technical requirements for enrollment and identity proofing. It also outlines what Credential Service Providers (CSPs) are responsible for in managing records and official authenticators.

Who needs to comply with NIST 800-63A?

Any organization or Federal agency in the business of using identity proofing services need to be in compliance with these standards. The guidelines cover all aspects of authentication for users interacting with government IT systems. The standards also apply to those who provide identity proofing services.

How can Continuum GRC help with NIST SP 800-63A compliance?

Continuum GRC can ensure that your organization is covered for the specific compliance needs around digital identities and authentication. We’ll assess you organization to uncover any weak spots in your security processes and guide you through the regulations designed to protect these sensitive digital interactions.

Is NIST 800-63A the same as NIST 800-63?

No. NIST 800-63 is a larger set of documents determining the standards and practices around digital identity guidelines. NIST 800-63 covers broader issues like authentication and lifecycle management. NIST 800-63A drills down into the granular specifics around enrollment and identity proofing for digital identities.

What is the purpose of NIST 800-63A?

This document provides the guidelines for services dealing with digital identity, specifically the process of identity enrollment an identity proofing. It give the technical requirements that are needed to verify user identity and the identity of the real person providing that information. It’s meant to ensure that the evidence that’s supplied is authentic.

Benefits of implementing NIST 800-63A?

Utilizing NIST 800-63A demonstrates a commitment to data security and identity protection. It’s a must-have for dealing with Federal entities, but private citizens concerned about identity theft will also feel more confident in your organization when it is compliant in these important requirements.

It’s an extra layer of security in an environment of increasing threats.

What are you waiting for?

You are just a conversation away from putting the power of Continuum GRC to work for you.

Your Roadmap to Risk Reduction!