For Cloud Service Providers (CSPs) targeting the FedRAMP High baseline (Class D in FedRAMP's 2026 rules, which also rename authorization to certification), the transition to Revision 5 has brought rigorous scrutiny to Identity and Access Management (IAM). Following the release of the updated FedRAMP authorization documents in December 2025, some confusion has circulated among CSPs: the belief that standard IAL2 identity proofing, if done "in-person," is sufficient for the High baseline.
This is incorrect.
At Trust Swiftly, we have analyzed the raw text of the most recent FedRAMP SAR Appendix B - High Security Requirements Traceability Matrix (the Rev5 template, now listed under FedRAMP Legacy Documentation). The data is irrefutable: FedRAMP High requires Identity Assurance Level 3 (IAL3). In previous templates IAL3 was specifically a standalone statement in the traceability, but it is now slightly moved in separate columns for the documentation.
Here is the breakdown of the new requirements and why "enhanced IAL2" will cause you to fail your audit.
The "Hidden" Mandate in Control IA-5
If you only review Control IA-12 (Identity Proofing), the requirement seems ambiguous. The control text instructs CSPs to proof users based on the "appropriate identity assurance level." Many Compliance Officers mistakenly interpret "appropriate" as "IAL2," assuming IAL3 is too difficult to implement.
However, the specific mandate is located in Control IA-5 (Authenticator Management).
According to the FedRAMP High baseline text (Page 276 of the SSP Appendix A), the requirement is explicit:
"IA-5 Requirement: Authenticators must be compliant with NIST SP 800-63-3 Digital Identity Guidelines IAL, AAL, FAL level 3."
That legacy template cites SP 800-63-3. FedRAMP's 2026 Rev5 control guidance now says Class D authenticators "must be compliant with the most recent NIST Digital Identity Guidelines IAL, AAL, FAL level 3", which today is revision 4 (SP 800-63-4). This post uses its requirements.
This single line closes the loop. You cannot bind an AAL3 authenticator (required for High) to an identity that was only proofed to IAL2 standards. The entire chain of trust—Identity (IAL), Authenticator (AAL), and Federation (FAL)—must be Level 3.
Why "IAL2 In-Person" is Not IAL3
We often hear CSPs ask: "If I verify a driver's license in person, isn't that IAL3?"
Not on its own. An in-person license check still misses the controls that make a session IAL3.
Under NIST SP 800-63A-4, IAL2 and IAL3 collect the same identity evidence: one SUPERIOR piece, two STRONG pieces, or one STRONG plus one FAIR (§4.2.2 and §4.3.2). IAL3 adds requirements on how and where the session runs:
On-site attended only (§4.3.1): a trained proofing agent attends every session, in the room or through a CSP-controlled kiosk or device. A video call on the applicant's own laptop or phone cannot reach IAL3.
A biometric is collected and retained (§4.3.3) to support account recovery and non-repudiation.
Evidence validation (§4.3.4): SUPERIOR evidence, such as a passport chip, is validated cryptographically. FAIR and STRONG evidence may be validated by scanning technology or by a trained agent's visual or physical inspection.
Initial authenticator binding (§4.3.10) happens during the attended session.
An assessor looks for all four: controlled equipment, a trained agent, a retained biometric and an attended authenticator binding. For a fuller comparison of the levels, see What Is NIST IAL3?
The Trust Swiftly Advantage: Solving IAL3 for FedRAMP High
Achieving IAL3 compliance internally is operationally expensive and technically complex. It requires specialized hardware, trained agents, and biometric processing capabilities that most CSPs do not possess. HR teams do not have the capacity alone to take on this role and require an auditable and secure process for employees.
Trust Swiftly abstracts this complexity. We provide the IAL3 layer required to satisfy FedRAMP High controls IA-12 and IA-5.
How We Map to the Dec 2025 Requirements:
IA-12 (Identity Proofing): We deliver on-site attended IAL3 proofing as NIST SP 800-63A-4 defines it. Your user completes the session on a Trust Swiftly-controlled kit or kiosk at an approved office or home office, and a trained proofing agent attends over high-resolution video (the kiosk-based model in §4.3.8; earlier revisions called it supervised remote identity proofing), or in the room for on-site events. The agent oversees evidence collection, validation and the biometric capture.
IA-5 (Authenticator Management): The initial authenticator is bound during the attended session (§4.3.10), so the AAL3 hardware authenticators you issue, such as YubiKeys, are tied to an IAL3-proofed identity.
SC-13 (Cryptographic Protection): Our verification processes use NIST-approved algorithms, with FIPS 140-validated modules where a deployment requires them, to protect the integrity of the proofing record.
IA-12 in the High Baseline: What a Session Record Supplies
The NIST SP 800-53B High baseline, which FedRAMP High builds on, includes IA-12 and enhancements (2) through (5). For each, this is what the assessor tests and what a Trust Swiftly IAL3 session record supplies.
| Control | What the assessor tests | What the session record supplies |
|---|---|---|
| IA-12 | Users are proofed to the right IAL; identities resolve to one person; evidence is collected, validated and verified | The outcome at IAL3, the core-attribute resolution, and the evidence validation and verification results |
| IA-12(2) | Evidence is presented to the registration authority | The evidence captured on the kit during the attended session, and the attending agent's record |
| IA-12(3) | Evidence is validated and verified by defined methods | The validation method and result for each piece of evidence: chip, scan or agent inspection |
| IA-12(4) | Validation and verification happen in person before a designated registration authority | An on-site attended session on a Trust Swiftly-controlled kit, with the trained agent attending (SP 800-63A-4 Sections 4.3.1 and 4.3.8) |
| IA-12(5) | A registration code or notice of proofing goes out-of-band to the address of record | The notification of proofing sent to a validated address (SP 800-63A-4 Section 4.3.9) |
Class C (Moderate) sits at IAL2 in FedRAMP's 2026 Rev5 guidance; Class D (High) requires level 3 (FedRAMP Rev5 control guidance).
Conclusion
As of January 2026, the ambiguity is gone. If you are pursuing FedRAMP High, you cannot shortcut Identity Assurance. The baseline requires Level 3 across the board.
Don't risk a "Not Satisfied" finding in your SAR. Partner with Trust Swiftly for an IAL3 workflow built to NIST SP 800-63A-4.
Key Takeaways for Your SSP (Rev 5)
Control IA-2: Requires Phishing-Resistant MFA.
Control IA-5: Explicitly mandates IAL3 / AAL3 / FAL3.
Control IA-12: IAL3 proofing is on-site attended only, with a trained agent in the room or attending through a CSP-controlled kiosk or device, and a retained biometric.
Contact Trust Swiftly today to ready your IAM architecture for FedRAMP High.