Make identity proofing recoverable, equitable, and evidence-based

Source facts: proofing and authentication answer different questions

NIST Special Publication 800-63A-4 addresses identity proofing and enrollment for digital authentication. During proofing, an applicant presents evidence to a credential service provider so the provider can resolve the applicant to a unique identity, validate evidence, and verify that the applicant is associated with that identity. Authentication later establishes control of an authenticator. A strong authenticator does not correct a proofing process that enrolled an impostor.

The publication defines three identity assurance levels. IAL1 does not require linking the applicant to a specific real-life identity. IAL2 and IAL3 apply progressively stronger requirements based on the service’s risk and need for confidence. The guideline supports remote and attended processes under stated requirements and includes controls for evidence, validation, verification, notification, records, privacy, security, fraud mitigation, and redress.

NIST also emphasizes customer experience and equity. Proofing failures and inaccessible methods can prevent legitimate people from receiving a service. The provider must consider privacy risk, data minimization, notice and consent, protection of personal information, alternative methods where required, and mechanisms for resolving complaints or correcting errors. Biometrics, when used, are one part of a controlled process rather than an identity by themselves.

DSE recommendation: choose assurance from the transaction’s harm

For each service, describe what a falsely enrolled identity could authorize, learn, alter, receive, or deny. Consider harm to the applicant, other people, the organization, and external parties. Decide whether a real-world identity is necessary at all; collecting identity evidence without a defined need creates privacy and breach exposure.

When proofing is required, document the target assurance level, eligible evidence, authoritative or credible sources, resolution rules, validation checks, verification methods, fraud controls, retention, and approval. Keep this decision separate from authenticator strength and federation choices so one strong layer does not conceal a weak one.

DSE recommendation: design every enrollment path and failure path

1. Map the applicant journey. Cover normal remote and attended enrollment, low-connectivity conditions, name changes, limited documentation, accessibility needs, failed automated checks, duplicate records, and suspected fraud.
2. Minimize proofing data. Collect and retain only what the approved purpose requires. Restrict operator and system access, protect transmissions and stored records, and set defensible deletion schedules.
3. Separate duties for exceptions. High-risk overrides should require documented evidence and independent approval. An operator should not be able to invent, approve, and conceal an identity exception alone.
4. Notify through a validated channel. Give the subject a meaningful opportunity to detect an enrollment they did not initiate without exposing sensitive proofing details in the notice.
5. Build redress outside the failed mechanism. A person rejected because a document or biometric check failed needs a secure way to challenge the result that does not simply repeat the same test.

DSE recommendation: measure fraud and legitimate-user harm together

Test presentation attacks, forged evidence, stolen identity data, synthetic identities, insider misuse, replay, source unavailability, and account-linking errors. Also test accessibility, language, device limitations, demographic performance where legally and operationally appropriate, completion rates, abandonment, false rejection, appeal time, and correction accuracy.

Protect detailed fraud signals from public disclosure that would enable evasion, but provide governance with enough evidence to compare paths. Review vendors for subcontractors, data locations, model and process changes, breach duties, evidence access, retention, and termination support. Include proofing service outages and supplier termination in continuity exercises so legitimate enrollment does not depend on an untested fallback. Record assurance decisions, test results, exception rates, complaints, redress outcomes, and approved improvements. Identity proofing is trustworthy only when it resists impersonation while giving legitimate people a safe, understandable, and correctable route to enrollment.

Official references

• National Institute of Standards and Technology, SP 800-63A-4: Digital Identity Guidelines—Identity Proofing and Enrollment, July 31, 2025; reviewed August 11, 2026.