4 Identity Assurance Level Requirements

This section is normative.

1. Oversigt

4.1 Identity Assurance Level 1 Requirements

Identity proofing processes at IAL1 allow for a range of acceptable techniques to detect fraudulent claims to identities by malicious actors while facilitating user adoption, minimizing the rejection of legitimate users, and reducing application departures. The use of biometric matching (e.g., automated comparison of the applicant’s facial image to a facial portrait on supplied evidence) is optional at IAL1.

4.2 Identity Assurance Level 2 Requirements

IAL2 identity proofing includes additional evidence, validation, and verification requirements to better mitigate impersonation attacks and other identity proofing errors relative to IAL1. IAL2 can be achieved through different types of identity proofing (e.g., remote unattended, remote attended), and identity verification at IAL2 can be accomplished with or without the use of biometrics. This section presents three different pathways to align with IAL2 outcomes and requirements: IAL2 Verification — Non-Biometric Pathway, IAL2 Verification — Biometric Pathway, and IAL2 Verification — Digital Evidence Pathway.

4.3 Identity Assurance Level 3

IAL3 adds additional rigor to the steps required at IAL2 and is subject to additional and specific processes, including the use of biometric information comparison, collection, and retention, to further protect the identity and RP from impersonation and other forms of identity fraud. In addition, identity proofing at IAL3 is performed onsite and attended by a proofing agent, as described in Sec. 2.1.2.

4.4 Summary of Requirements

Table 1 summarizes the requirements for each of the identity assurance levels.

Table 1. IAL requirements summary

Process	IAL1	IAL2	IAL3
Proofing Types	Remote Unattended Remote Attended On-Site Unattended On-Site Attended	Same as IAL1	On-Site Attended
Evidence Collection	Attended: • 1 FAIR, or • 1 STRONG, or • 1 SUPERIOR Unattended: • 1 FAIR, or • 1 STRONG, or • 1 SUPERIOR	For all proofing types: • 1 FAIR + 1 STRONG, or • 2 STRONG, or • 1 SUPERIOR	For all proofing types: • 1 FAIR + 1 STRONG, or • 2 STRONG, or • 1 SUPERIOR
Attribute Collection	All Core Attributes	All Core Attributes	All Core Attributes + Biometric Sample
Evidence Validation	Physical Evidence: • Automated document authentication • Visual inspection • Physical/tactile inspection Digital Evidence: • Interrogation of digital security features	Same as IAL1, plus: SUPERIOR Evidence: • Digital signature verification	Same as IAL2
Attribute Validation	• Confirmation of core attributes against authoritative or credible sources • Confirmation of digitally signed attributes through digital signature verification	Same as IAL1	Same as IAL2
Verification	Verify applicant’s ownership of the FAIR, STRONG, or SUPERIOR evidence per 4.1.6	Verify applicant’s ownership of all presented evidence using methods provided in 4.2.6	Verify applicant’s ownership of all presented evidence using methods provided in 4.3.6

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav
Kilde	Krav

3. Relaterede reguleringer

Reguleringer
Kilde	Regulering

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.