What it covers. NIST guidelines for digital identity services, covering identity proofing and enrolment, authentication and federation. They define assurance levels for each area: identity assurance, authenticator assurance and federation assurance. The current revision is SP 800-63-4, organised into a base document and volumes A, B and C.
In practice. Organisations assess the risk of each digital service and select the assurance level needed for proofing, authentication and federation. They choose authenticators accordingly, favour phishing-resistant options for higher risk, and follow the guidance on password handling, such as checking against compromised password lists rather than forcing periodic changes. Evidence includes the risk assessment, chosen assurance levels and configuration of identity systems.
Common gaps. Common gaps are applying one authentication level to everything, keeping outdated password rules, and weak account recovery processes that undermine strong authentication.