index.html

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="theme-color" media="(prefers-color-scheme: light)" content="white">
    <meta name="theme-color" media="(prefers-color-scheme: dark)" content="black">
    <link rel="canonical" href="/800-63-4/">

    <!-- Google Analytics -->
    <!--<script type="text/javascript" id="_fed_an_js_tag" src="http://www.nist.gov/js/federated-analytics.all.min.js?agency=NIST&subagency=mml&pua=UA-66610693-1&yt=true&exts=ppsx,pps,f90,sch,rtf,wrl,txz,m1v,xlsm,msi,xsd,f,tif,eps,mpg,xml,pl,xlt,c"></script> -->
    <!-- DAP Analytics -->
    <script type="text/javascript" id="_fed_an_ua_tag"
            src="https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=DOC&subagency=NIST&pua=UA-66610693-1&yt=true&exts=ppsx,pps,f90,sch,rtf,wrl,txz,m1v,xlsm,msi,xsd,f,tif,eps,mpg,xml,pl,xlt,c"></script>

	<link rel="stylesheet" href="https://pages.nist.gov/nist-header-footer/css/nist-combined.css">
	<script src="https://code.jquery.com/jquery-3.6.2.min.js" type="text/javascript"></script>
	<script src="https://pages.nist.gov/nist-header-footer/js/nist-header-footer.js" type="text/javascript" defer="defer"></script>
	<script src="https://unpkg.com/simple-jekyll-search/dest/simple-jekyll-search.min.js"></script>

    <!-- Custom CSS -->
    <link rel="stylesheet" href="/800-63-4/static/font-awesome/css/font-awesome.min.css">
    <link rel="stylesheet" href="/800-63-4/static/css/NISTStyle.css">
    <link rel="stylesheet" href="/800-63-4/static/css/NISTPages.css">

    <!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
    <!--[if lt IE 9]>
    <script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
    <script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script>
    <![endif]-->

    
    <title>NIST SP 800-63 Digital Identity Guidelines</title>
    <meta property="og:title" content="NIST SP 800-63 Digital Identity Guidelines"/>
    

    
    <meta name="description" content="NIST Special Publication 800-63 Digital Identity Guidelines">
    <meta property="og:description" content="NIST Special Publication 800-63 Digital Identity Guidelines"/>
    
</head>


    <section class="home home-title">
        <h1>NIST SP 800-63 Digital Identity Guidelines</h1>
    </section>

    <section class="home home-about">
        <div class="section-container">
        <h2 id="background">Background</h2>

<p>In July 2025, NIST released the final version of SP 800-63, Revision 4. The culmination of an almost four-year process that included foundational research, two public drafts, and nearly 6,000 individual comments from the public, Revision 4 of SP 800-63, <em>Digital Identity Guidelines</em>, intends to respond to the changing digital landscape that has emerged since the last major revision of this suite was published in 2017. The guidelines present the process and technical requirements for meeting digital identity assurance levels for identity proofing, authentication, and federation, including requirements for security and privacy as well as considerations for improved customer experience of digital identity solutions and technology. This revision includes many substantial content changes, including the following:</p>

<ol>
  <li>Updates text and context setting for risk management</li>
  <li>Adds recommended continuous evaluation metrics</li>
  <li>Expands fraud requirements and recommendations for identity proofing processes</li>
  <li>Restructures the identity proofing controls to better define roles and types of identity proofing</li>
  <li>Adds controls for addressing injection attacks and forged media (e.g., “deep fakes”)</li>
  <li>Integrates syncable authenticators (e.g., synced passkeys)</li>
  <li>Adds subscriber-controlled wallets to the federation model</li>
</ol>

<p>Among many other changes, these represent a comprehensive update from Revision 3. As with previous revisions, implementation resources such as FAQs, conformance criteria, and more will be made available in the near future.</p>

<h2 id="online-versions">Available Online</h2>

<p>The online versions of the four volumes of draft SP 800-63-4 are available at:</p>

<ul class="audiences">
<li>
  <div>
    <a href="sp800-63.html"><img src="assets/63.png" alt="SP 800-63-4" width="150px" height="150px" /></a>
  </div>
  <h3><a href="sp800-63.html">SP 800-63-4</a></h3>
  <h6>Digital Identity Guidelines</h6>
</li>
<li>
  <div>
    <a href="sp800-63a.html"><img src="assets/63a.png" alt="SP 800-63A-4" width="150px" height="150px" /></a>
  </div>
  <h3><a href="sp800-63a.html">SP 800-63A-4</a></h3>
  <h6>Identity Proofing &amp; Enrollment</h6>
</li>
<li>
  <div>
    <a href="sp800-63b.html"><img src="assets/63b.png" alt="SP 800-63B-4" width="150px" height="150px" /></a>
  </div>
  <h3><a href="sp800-63b.html">SP 800-63B-4</a></h3>
  <h6>Authentication &amp; Authenticator Management</h6>
</li>
<li>
  <div>
    <a href="sp800-63c.html"><img src="assets/63c.png" alt="SP 800-63C-4" width="150px" height="150px" /></a>
  </div>
  <h3><a href="sp800-63c.html">SP 800-63C-4</a></h3>
  <h6>Federation &amp; Assertions</h6>
</li>
</ul>

<p>PDF versions of these documents are available on the NIST Computer Security Resource Center:</p>

<ul>
  <li><a href="https://csrc.nist.gov/pubs/sp/800/63/4/final">https://csrc.nist.gov/pubs/sp/800/63/4/final</a></li>
  <li><a href="https://csrc.nist.gov/pubs/sp/800/63/A/4/final">https://csrc.nist.gov/pubs/sp/800/63/A/4/final</a></li>
  <li><a href="https://csrc.nist.gov/pubs/sp/800/63/B/4/final">https://csrc.nist.gov/pubs/sp/800/63/B/4/final</a></li>
  <li><a href="https://csrc.nist.gov/pubs/sp/800/63/C/4/final">https://csrc.nist.gov/pubs/sp/800/63/C/4/final</a></li>
</ul>

<h2 id="implementation-resources">Implementation Resources</h2>

<ul>
  <li><em>Coming Soon</em> Frequently Asked Questions</li>
  <li><em>Coming Soon</em> SP 800-63A-4 Conformation Criteria</li>
  <li><em>Coming Soon</em> SP 800-63B-4 Conformance Criteria</li>
  <li><em>Coming Soon</em> SP 800-63C-4 Conformance Criteria</li>
  <li><em>Coming Soon</em> Additional Informative Resources</li>
</ul>

        </div>
    </section>


<footer role="contentInfo" class="site-footer">
  <div class="section-container">
    <div class="section-content">
    </div>
  </div>
</footer>

<script type="text/javascript">
    function loadSearch() {
        var sjs = SimpleJekyllSearch({
          searchInput: document.getElementById('search-input'),
          resultsContainer: document.getElementById('results-container'),
          json: '/800-63-4/search.json'
        });
    }
    $(function() {
      
      // highlight normative language by adding classes
      $('strong').filter(':contains("SHALL"), :contains("SHALL NOT"), :contains("SHOULD"), :contains("SHOULD NOT"), :contains("MAY"), :contains("NEED NOT"), :contains("CAN"), :contains("CANNOT"), :contains("CAPITALS")').each(function(i, el) {
        var $el;
        $el = $(el);
        $el.addClass('normative');
      });
      // highlight the target
      $('a:target').parent().addClass('target');
      $(':target').addClass('target');
      $(window).on('hashchange', function(e) {
        $('.target').removeClass('target');
        $('a:target').parent().addClass('target');
        $(':target').addClass('target');
      });
    });
</script>

</body>
</html>