Download: the FedRAMP High IAL3 readiness checklist (PDF, 3 pages), with each evidence group mapped to NIST’s IAL3 conformance criteria. More templates are on our buyer resources page.
When teams preparing for a FedRAMP High (Class D) assessment struggle with IAL3, the usual cause is evidence fragmented across systems, owners, and formats.
This checklist is built to prevent that. Use it to package a defensible, review-friendly record for your independent assessor before the audit window opens.
If you are building your full program first, start with the Enterprise IAL3 Implementation Hub.
What assessors will expect to see
A clear control narrative linking identity proofing events to account provisioning and authenticator binding.
Evidence that the same person proofed is the same person receiving privileged access.
Documented exception handling, re-verification triggers, and account recovery safeguards.
Repeatable operating procedures backed by records from day-to-day operation.
IAL3 audit evidence checklist
1. Policy and governance artifacts
Identity proofing policy defining populations, assurance targets, and ownership.
Role matrix (Security, IAM, HR, Compliance) with approval boundaries.
Exception policy including approval authority and expiration windows.
Retention and disposal policy for identity evidence and associated metadata.
2. Enrollment and proofing workflow evidence
Documented attended proofing process for IAL3 candidates.
Evidence capture specification (identity documents, biometrics, session context).
Proof that verification artifacts are tamper-resistant and time-bound.
Chain-of-custody documentation for any hardware-assisted flow.
3. Authenticator binding and access lifecycle evidence
Procedure showing how IAL3 identity is bound to an AAL3-capable authenticator.
Provisioning logs with user, role, approver, and timestamp lineage.
Recovery flow controls to prevent help-desk bypass of high-assurance identity.
Revocation and re-issue records for lost, stolen, or compromised authenticators.
4. Operational control evidence
Runbooks for failed checks, suspected impersonation, and stale identity records.
Ticket samples proving that exceptions are tracked to closure.
Periodic access recertification outputs for privileged users.
Evidence quality reviews showing each control has been tested.
5. Re-verification and continuous assurance evidence
Trigger policy for re-verification (role change, recovery, high-risk events).
Sample events showing successful trigger, review, and decision outcomes.
Metrics dashboard for verification completion time, failure rates, and exception volume.
Documented linkage between risk signals and identity step-up actions.
Map your evidence to NIST’s IAL3 conformance criteria
NIST’s conformance criteria for SP 800-63A-4 number the IAL3 requirements IAL3-1 to IAL3-24. Group your evidence the same way so your assessor can test it criterion by criterion. Our walk-through of the IAL3 conformance criteria explains each one.
| Group | NIST criteria | Evidence to have ready |
|---|---|---|
| Setting and proofing type | IAL3-1, IAL3-7, IAL3-11 | Where each session took place (an approved private location), that it was on-site attended, and who attended. |
| Attended session and recording | IAL3-12 to IAL3-17 | Agent attendance on live high-resolution video, the recording notice and consent, and the recording retention schedule. |
| Controlled devices | IAL3-18 to IAL3-21 | The kit or kiosk allow-list, who controls each device between sessions, and inspection and chain-of-custody records. |
| Evidence and verification | IAL3-2 to IAL3-6, IAL3-8 to IAL3-10 | The evidence collected, its validation against the issuer, and the biometric comparison result. |
| Notification and authenticator | IAL3-22 to IAL3-24 | The notice of proofing sent to a validated address, and the authenticator enrolled during the session. |
Assessors can request Trust Swiftly’s full control-by-control IAL3 conformance mapping under NDA.
Common evidence gaps to close now
Control text without operating proof: Teams provide policy language but no evidence of day-to-day execution.
Disconnected systems: Proofing logs, IAM records, and ticketing data do not share a common identifier.
Weak recovery controls: Account recovery paths downgrade assurance unintentionally.
No exception lifecycle: Exceptions are approved but never reviewed for closure or renewal.
How to package evidence for review speed
Create one evidence index per control family with owner, source system, and last validation date.
Attach one representative "happy path" and one "exception path" artifact set for each high-risk workflow.
Normalize export formats and naming conventions before your pre-assessment review.
Assign a single evidence coordinator to eliminate duplicate or conflicting submissions.
For teams that need implementation support, pair this checklist with NIST IAL3 Verification and where IAL3 Kits ship.
Request an IAL3 evidence readiness workshop and we will map this checklist to your current program.