THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · IA-12

Identity Proofing

US National Institute of Standards and Technology (NIST) · cited in 17 of our lessons

Explanation

What it asks for. Users who need accounts must be identity-proofed to an appropriate assurance level, with their identity evidence resolved, validated and verified according to defined requirements.

In practice. This means checking identity documents or trusted HR records at onboarding, and applying stronger proofing for higher-risk access or for remote onboarding where impersonation is easier. The same rigour should apply to account recovery. Auditors look for proofing procedures, records showing they were followed and how remote and contractor onboarding is handled. eIDAS assurance levels and NIST SP 800-63A offer reference models.

Common gaps. Remote hiring has made impersonation and fraudulent worker schemes easier, and many proofing processes have not adapted. Help desk recovery often bypasses the original proofing standard.

Open SP 800-53 at NIST
The official text
a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines; b. Resolve user identities to a unique individual; and c. Collect, validate, and verify identity evidence. Discussion: Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 17.