[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fia-12":3},{"item":4,"lessons":18,"controls":68,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ia-12","IA-12","Identity Proofing",17,"US National Institute of Standards and Technology (NIST)","**What it asks for.** Users who need accounts must be identity-proofed to an appropriate assurance level, with their identity evidence resolved, validated and verified according to defined requirements.\n\n**In practice.** This means checking identity documents or trusted HR records at onboarding, and applying stronger proofing for higher-risk access or for remote onboarding where impersonation is easier. The same rigour should apply to account recovery. Auditors look for proofing procedures, records showing they were followed and how remote and contractor onboarding is handled. eIDAS assurance levels and NIST SP 800-63A offer reference models.\n\n**Common gaps.** Remote hiring has made impersonation and fraudulent worker schemes easier, and many proofing processes have not adapted. Help desk recovery often bypasses the original proofing standard.","a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;\n  b. Resolve user identities to a unique individual; and\n  c. Collect, validate, and verify identity evidence.\nDiscussion: Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include [SP 800-63-3](#737513fa-6758-403f-831d-5ddab5e23cb3) and [SP 800-63A](#9099ed2c-922a-493d-bcb4-d896192243ff) . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"north-korean-it-worker-fraud-exposes-hiring-and-identity-verification-gaps","North Korean IT Worker Fraud Exposes Hiring and Identity Verification Gaps","2026-10-14T18:21:30.184+00:00",{"slug":25,"title":26,"published_at":27},"telco-found-liable-for-gdpr-breach-after-identity-fraud-enabled-by-weak-verification","Telco Found Liable for GDPR Breach After Identity Fraud Enabled by Weak Verification","2026-10-14T18:20:33.817+00:00",{"slug":29,"title":30,"published_at":31},"north-korean-it-worker-laptop-farms-expose-hiring-identity-verification-gaps","North Korean IT Worker Laptop Farms Expose Hiring & Identity Verification Gaps","2026-10-14T12:21:20.742+00:00",{"slug":33,"title":34,"published_at":35},"north-korean-remote-work-fraud-identity-theft-funds-weapons-programs","North Korean Remote Work Fraud: Identity Theft Funds Weapons Programs","2026-10-13T22:20:17.411+00:00",{"slug":37,"title":38,"published_at":39},"15000-money-mules-used-to-launder-millions-in-cybercrime-proceeds","15,000 Money Mules Used to Launder Millions in Cybercrime Proceeds","2026-10-09T12:21:43.354+00:00",{"slug":41,"title":42,"published_at":43},"zero-trust-has-a-day-one-blind-spot-the-onboarding-identity-gap","Zero Trust Has a Day-One Blind Spot: The Onboarding Identity Gap","2026-10-01T16:22:29.214+00:00",{"slug":45,"title":46,"published_at":47},"revolut-breach-social-engineering-exposes-millions-of-user-records","Revolut Breach: Social Engineering Exposes Millions of User Records","2026-09-14T14:20:39.932+00:00",{"slug":49,"title":50,"published_at":51},"stolen-police-credentials-expose-florida-dmv-driver-database","Stolen Police Credentials Expose Florida DMV Driver Database","2026-09-11T20:20:34.007+00:00",{"slug":53,"title":54,"published_at":55},"north-korean-it-worker-infiltration-spotting-the-red-flags","North Korean IT Worker Infiltration: Spotting the Red Flags","2026-08-26T22:21:17.307+00:00",{"slug":57,"title":58,"published_at":59},"north-korean-operatives-infiltrate-companies-as-fake-remote-workers","North Korean Operatives Infiltrate Companies as Fake Remote Workers","2026-08-26T14:20:42.033+00:00",{"slug":61,"title":62,"published_at":63},"mfa-alone-is-not-enough-the-identity-verification-gap","MFA Alone Is Not Enough: The Identity Verification Gap","2026-08-26T12:21:09.951+00:00",{"slug":65,"title":66,"published_at":67},"identity-verification-gaps-enable-impersonation-and-insider-threats","Identity Verification Gaps Enable Impersonation and Insider Threats","2026-08-25T16:21:39.613+00:00",[69,74,78,83,87,92],{"slug":70,"name":71,"problem":72,"stories":73},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",9,{"slug":75,"name":76,"problem":77,"stories":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":79,"name":80,"problem":81,"stories":82},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",7,{"slug":84,"name":85,"problem":86,"stories":82},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":88,"name":89,"problem":90,"stories":91},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,{"slug":93,"name":94,"problem":95,"stories":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",2,[98,104,108,114,118,122,128,132],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","6","Control 6","Access Control Management",16,{"family":5,"item":105,"code":106,"title":107,"together":103},"ac-2","AC-2","Account Management",{"family":109,"item":110,"code":111,"title":112,"together":113},"gdpr","32","Article 32","Security of processing",13,{"family":115,"item":116,"code":117,"title":117,"together":73},"itil","overview","ITIL",{"family":99,"item":119,"code":120,"title":121,"together":73},"14","Control 14","Security Awareness and Skills Training",{"family":123,"item":124,"code":125,"title":126,"together":127},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",8,{"family":99,"item":129,"code":130,"title":107,"together":131},"5","Control 5",5,{"family":5,"item":133,"code":134,"title":135,"together":91},"ia-5","IA-5","Authenticator Management"]