NIST Special Publication 800-63A-4 addresses identity proofing and enrollment for digital authentication. During proofing, an applicant presents evidence to a credential service provider so the provider can resolve the applicant to a unique identity, validate evidence, and verify that the applicant is associated with that identity. Authentication later establishes control of an authenticator. A strong authenticator does not correct a proofing process that enrolled an impostor.
\n\nThe publication defines three identity assurance levels. IAL1 does not require linking the applicant to a specific real-life identity. IAL2 and IAL3 apply progressively stronger requirements based on the service’s risk and need for confidence. The guideline supports remote and attended processes under stated requirements and includes controls for evidence, validation, verification, notification, records, privacy, security, fraud mitigation, and redress.
\n\nNIST also emphasizes customer experience and equity. Proofing failures and inaccessible methods can prevent legitimate people from receiving a service. The provider must consider privacy risk, data minimization, notice and consent, protection of personal information, alternative methods where required, and mechanisms for resolving complaints or correcting errors. Biometrics, when used, are one part of a controlled process rather than an identity by themselves.
\n\nFor each service, describe what a falsely enrolled identity could authorize, learn, alter, receive, or deny. Consider harm to the applicant, other people, the organization, and external parties. Decide whether a real-world identity is necessary at all; collecting identity evidence without a defined need creates privacy and breach exposure.
\n\nWhen proofing is required, document the target assurance level, eligible evidence, authoritative or credible sources, resolution rules, validation checks, verification methods, fraud controls, retention, and approval. Keep this decision separate from authenticator strength and federation choices so one strong layer does not conceal a weak one.
\n\nTest presentation attacks, forged evidence, stolen identity data, synthetic identities, insider misuse, replay, source unavailability, and account-linking errors. Also test accessibility, language, device limitations, demographic performance where legally and operationally appropriate, completion rates, abandonment, false rejection, appeal time, and correction accuracy.
\n\nProtect detailed fraud signals from public disclosure that would enable evasion, but provide governance with enough evidence to compare paths. Review vendors for subcontractors, data locations, model and process changes, breach duties, evidence access, retention, and termination support. Include proofing service outages and supplier termination in continuity exercises so legitimate enrollment does not depend on an untested fallback. Record assurance decisions, test results, exception rates, complaints, redress outcomes, and approved improvements. Identity proofing is trustworthy only when it resists impersonation while giving legitimate people a safe, understandable, and correctable route to enrollment.
\n\n