Get the editable version: the IAL3 vendor RFP template and scorecard (Excel), with these requirement blocks, NIST’s IAL3 conformance questions and a weighted scorecard that totals itself.
Many enterprise teams run an IAL3 procurement process with a generic KYC checklist. That almost always leads to painful rework during implementation or audit.
Use this RFP structure instead. It is designed for high-assurance IAL3 identity proofing where compliance quality, evidence integrity, and lifecycle operations matter as much as price.
For rollout sequencing and related implementation resources, see the Enterprise IAL3 Implementation Hub.
Copy-and-paste RFP requirement blocks
1. Compliance and control alignment
Describe how your workflow supports IAL3 on-site attended proofing and identity binding for privileged access users.
Provide a control mapping sample that ties platform outputs to audit evidence requirements.
Detail retention, re-verification, and recovery control options for regulated environments.
2. Security architecture and evidence integrity
Explain how verification artifacts are protected from tampering and unauthorized access.
Describe chain-of-custody protections for hardware-assisted or kit-based attended workflows.
Provide logging/export capabilities for forensic and compliance use.
3. IAM and enterprise integration
List integrations for identity providers, ticketing systems, and workflow orchestration.
Describe how proofing outcomes are bound to authenticator provisioning and account lifecycle events.
Show how exception handling and approvals can be tracked in existing governance systems.
4. Deployment and operations
Provide implementation timeline assumptions for pilot and production phases.
Describe support for distributed workforce use cases, including remote and in-office models.
Include operational SLAs for verification turnaround, incident response, and escalation.
5. Commercial model and total cost
Provide transparent pricing by volume, user type, and service model.
Break out one-time onboarding costs versus recurring operations.
Describe cost impact for re-verification, account recovery, and exception workflows.
Weighted scorecard for enterprise selection
| Category | Weight | Scoring prompt |
|---|---|---|
| Compliance defensibility | 30% | Will this hold up under independent assessor and internal audit scrutiny? |
| Security architecture | 25% | Can we trust the integrity and traceability of identity evidence? |
| Operational fit | 20% | Can Security, IAM, and HR run this without excessive manual burden? |
| Integration readiness | 15% | Will this plug into existing IAM and governance systems quickly? |
| Commercial efficiency | 10% | Does total cost stay predictable at enterprise scale? |
NIST IAL3 conformance questions for every vendor
NIST’s conformance criteria for SP 800-63A-4 number the IAL3 requirements IAL3-1 to IAL3-24. These ten questions, from our walk-through of the IAL3 criteria, test the requirements vendors most often blur. Ask each vendor to show the artifact behind its answer.
Which revision of SP 800-63 is your IAL3 service built and assessed against, and when was it assessed?
Is every IAL3 session on-site attended, and where do sessions take place? (IAL3-1, IAL3-7)
Do your station’s own sensors read chips and digital IDs, or can an applicant’s personal phone submit evidence? (IAL3-18)
Who controls the station between sessions? Show a redacted inspection record. (IAL3-19 to IAL3-21)
How do you verify SUPERIOR evidence back to a trust anchor? (IAL3-5)
How long do you retain the biometric sample, and where do applicants see that retention period? (SP 800-63A-4 §4.3.3)
Provide the recording notice, the consent step, and the video retention schedule applicants see. (IAL3-13)
Show the notice of proofing an applicant receives, and how you validate the address it goes to. (IAL3-22)
Demonstrate authenticator enrollment, and explain how you handle enrollment outside the attended session. (IAL3-23, IAL3-24)
Will you share a control-by-control mapping to NIST’s criteria, and let our assessor test it? (IAL3-1 to IAL3-24)
High-impact vendor questions most teams miss
How do you prevent identity-assurance downgrades during account recovery?
What evidence package can you provide before we sign, using anonymized samples?
How do you handle failed proofing retries without creating audit blind spots?
What controls exist to verify that the proofed person is the one receiving the authenticator?
What is your escalation model when we suspect impersonation or proxy-user behavior?
Red flags during evaluation
Vendor messaging focuses on "frictionless KYC" but cannot explain high-assurance lifecycle controls.
No clear evidence export model for audit, legal, and security operations.
Implementation plan assumes manual exception handling at enterprise volumes.
Pricing model hides re-verification and remediation costs.
IAL3 sessions can run on the applicant’s own phone or computer: SP 800-63A-4 requires on-site attended proofing on equipment the provider controls.
Need a technical baseline before issuing your RFP? Review the IAL3 audit evidence checklist and our control analysis.
Request an enterprise IAL3 RFP review to benchmark your criteria before you buy.
