IAL / AAL (NIST 800-63)

Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL) are NIST 800-63 metrics that separate identity proofing strength (IAL) from authentication strength (AAL). IAL gauges how confidently an organization has verified a person’s identity ranging from minimal evidence (remote, documentary-only) to high-assurance, in-person or multi-source verification. AAL evaluates the robustness of authenticators used at login from single-factor to phishing-resistant, multi-factor methods with hardware-backed keys.Many regulated programs target higher IAL for onboarding and higher AAL for sensitive actions. Decoupling proofing from authentication lets institutions tailor controls: e.g., strong document + biometric proofing at signup (IAL2/3) and passkeys or hardware keys for access (AAL2/3). NIST also defines Federation Assurance Level (FAL) for token assertions across domains. Clear mapping to risk appetites, plus periodic reviews, helps align products with auditors and regulators.