Assurance is the confidence that an authentication process correctly represents the identity of the entity being authenticated. It begins with enrollment and identity proofing: the stronger the verification, the higher the confidence that the claimed identity is genuine. section 3.4.2
Assurance is not the same as authorization. Strong authentication can establish that Charlie is Charlie, while enrollment context determines that he is a contractor, who sponsors him, what he may access, and when that access expires. section 3.4.3
NIST identity assurance levels classify the strength of proofing during enrollment:
- IAL1 provides low assurance through a self-asserted identity without formal proofing. section 3.4.2
- IAL2 provides moderate assurance by verifying trusted documents, potentially through a remote process. section 3.4.2
- IAL3 provides high assurance through in-person verification with biometrics or cryptographic binding. section 3.4.2
A supplier account with delegated authority
An individual may be proofed only to IAL1 while an organization is established by proving control of its domain. The individual can then submit invoices for the organization because enrollment created a delegation relationship; the individual’s assurance does not by itself establish organizational authority. section 3.4.3
Table 3.1 Summary of NIST Identity Assurance Levels (IAL), which define the strength of identity proofing during enrollment based on the required confidence in the claimed identity
| IAL Level |
Description |
Enrollment process example |
|---|---|---|
| IAL1 (low) |
Self-asserted identity; no formal identity proofing |
Signing up for an email account or a social media profile |
| IAL2 (moderate) |
Identity verified using trusted documents (e.g., driver’s license); verification may be remote |
Opening an online bank account with ID and selfie verification |
| IAL3 (high) |
In-person verification with biometrics or cryptographic binding to the identity |
Getting a passport, security clearance, or high-assurance enterprise login |
Compare IAL1, IAL2, and IAL3 enrollment strengths, requirements, and representative uses. section 3.4.2
Figure 3.4 Enrollment relationships between an individual, their organization, and a supplier system. The individual account is authenticated and proofed to IAL1, while the organization account is established through domain control. Delegation rights originate from the enrollment context and enable the individual to act on behalf of the organization within the supplier system.
Trace how an individual, organization, and supplier system connect through enrollment, proofing, and delegated action. section 3.4.3
Assurance depends on more than authentication strength. Stale attributes, weak account lifecycle management, and unverified changes can undermine access decisions, while systematic auditing provides evidence that identity controls work as intended. section 2.6.3
