NIST 800-63-4, released as the 2025 final version, marks a pivotal shift from checklist-based requirements towards risk-based Digital Identity Risk Management (DIRM) frameworks. It specifically prioritizes stronger authentication protocols like FIDO Passkeys while downgrading email OTPs and SMS to low assurance levels. The new framework emphasizes assurance levels to meet security and...

The IAL guidelines require a rigorous identity proofing process, typically consisting of an on-site attendance event with superior strength evidence validation requiring the presence of a CSP representative. NIST updates reflect an unmistakable shift toward prioritizing stronger, phishing-resistant authentication protocols, with email one-time passwords being deprecated and SMS authentication...