Built for FedRAMP High (Class D) • NIST SP 800-63A-4

Federal Identity Proofing for Programs and Contractors: NIST IAL2 and IAL3

NIST IAL3 proofing for FedRAMP High (Class D) programs, attended by trained agents on controlled hardware. IAL3 Kits ship to employee homes and agency offices from what we believe is the largest dedicated IAL3 fleet. Sensitive identity evidence stays inside FedRAMP-authorized, agency-owned, or contractor-managed boundaries. Your ISSO and Authorizing Official get a signed evidence package, and infiltration stops at the point of entry.

Talk to an IAL3 Specialist Capability Statement (PDF)

Need a buying path that fits government procurement? Ask about pilot programs, established contract vehicles (GSA, NASA SEWP), and bring-your-own-hardware and bring-your-own-agent (BYOH/BYOA) operating models that fit your internal security boundary.

NIST SP 800-63A-4 | SOC 2 Type II · ISO 27001 | Accessible workflows with accommodations

Analyst reviewing an identity verification timeline on a monitor and laptop beside a Trust Swiftly IAL3 Kit case and passport reader

50 states & 32+ countries More than 200 IAL3 Kits deploy to offices and employee homes: no travel, no fixed enrollment centers, and a trained agent on every session.

IAL2 + IAL3, one platform Run instant IAL2 pre-enrollment in parallel while attended IAL3 proofing is scheduled — urgent starts stay on track.

$100K spoofing challenge Public adversarial challenge against our proofing stack — zero successful bypasses as of October 2026.

Every kit inspected Hardware is physically inspected and chain-of-custody logged after each verification session.

IAL3 Requirements Under NIST SP 800-63A-4

NIST IAL3 is the highest identity assurance level in SP 800-63A-4: identity proofing performed on-site and attended by a proofing agent, with biometric collection and retention added to the IAL2 steps.

IAL3 identity proofing SHALL only be delivered as on-site attended. The proofing agent MAY be co-located with the applicant or attend the identity proofing session via a CSP-controlled kiosk or device. SP 800-63A-4 §4.3.1
For identity proofing at IAL3, the CSP SHALL collect: One piece of FAIR evidence and one piece of STRONG evidence, Two pieces of STRONG evidence, or One piece of SUPERIOR evidence. §4.3.2
The CSP SHALL collect and retain a biometric sample from the applicant during the identity proofing process §4.3.3
The CSP SHALL monitor the entire identity proofing session through a high-resolution video transmission with the applicant. §4.3.8
The CSP SHALL have a live proofing agent participate remotely with the applicant for the evidence collection, evidence validation, and verification steps of the identity proofing process. §4.3.8
Upon the successful completion of identity proofing at IAL3, the CSP SHALL send a notification of proofing to a validated address for the applicant §4.3.9
The CSP SHALL distribute or enroll the subscriber’s initial authenticator during an on-site attended interaction with a proofing agent. §4.3.10

In these requirements, the CSP (credential service provider) is the proofing provider. Trust Swiftly runs IAL3 sessions to these requirements, on a controlled IAL3 Kit or kiosk at an approved office or home with a trained agent attending. Every requirement, explained: What Is NIST IAL3?

Why the status quo fails

The federal identity crisis — and how to solve it

The Federal Problem

Legacy PIV/CAC issuance takes weeks, stalling mission-critical remote contractors. NIST SP 800-63A-4 now bars knowledge-based verification (KBV) for identity proofing — yet legacy programs still lean on credit-bureau quizzes that AI deepfakes defeat and that lock thin-file applicants out of government services. Meanwhile, multi-tenant SaaS identity platforms force agencies to hand over sensitive biometric PII to external environments — creating massive cyber risk and violating Zero Trust principles.

The Trust Swiftly Capability

An agile Identity Proofing Engine delivering continuous anti-spoofing & deepfake defense, IAL2/IAL3-aligned document vetting, and dynamic routing — helping legitimate users move quickly while suspicious sessions are escalated. Deploys inside FedRAMP-authorized cloud infrastructure for full data sovereignty without the burden of self-hosted infrastructure.

Mission Fit Snapshot

Built for NIST SP 800-63A-4 IAL3 programs that need controlled hardware, documented chain of custody, and a defensible operating model that helps protect CUI and mission-critical networks.

Security posture Controls built for FedRAMP High (Class D), the ability to support DoD IL4 and IL5 programs, and Zero Trust-ready evidence workflows built around NIST SP 800-63A-4 IAL3.

Operating control Choose IAL3 Kits, Office Kiosks, or the agency-operated model with government-owned hardware and internal verification agents to minimize supply chain risk.

Credentialing fit Strengthen remote HSPD-12 and PIV-adjacent proofing before credential issuance and high-risk access decisions.

Security posture

Security architecture built for federal contractors and teams pursuing FedRAMP

Trust Swiftly combines high-assurance identity proofing with hardened control signals that support ISSOs, CISOs, and mission-security stakeholders — aligned to Executive Order 14028 (Zero Trust Architecture) and OMB M-22-09 (Federal Zero Trust Strategy).

NIST SP 800-63A-4 Aligned

Designed to support high-assurance proofing controls, stronger evidence capture, and a defensible controlled capture path.

IA-12 Evidence for Every Session

A signed evidence package for each IAL3 session, mapped to IA-12 for programs pursuing FedRAMP High (Class D).

SOC 2 Type II

Independent control validation reinforces operational discipline, evidence handling, and process consistency.

ISO 27001

Supports mature governance around information security management, asset handling, and continuous control review.

Mission coverage

Reach headquarters staff, rural hires, field teams, and distributed contractors without limiting proofing to a handful of facilities.

Defensible evidence chain

Generate chain-of-custody artifacts and proofing records that stand up to ISSO review, RMF assessment against NIST SP 800-63A-4, and counter-infiltration programs.

Flexible operating control

Use managed kits, field-ready kiosks, or government-owned hardware and internal staffing without changing the core proofing platform.

Equitable access without travel

Enable homebound, disabled, and geographically remote applicants to complete identity proofing without traveling to a fixed enrollment site.

Photo of laptop and phone farm used for remote worker fraud against federal contractors

Mission risk

Modern fraud rings industrialize the endpoint. NIST SP 800-63A-4 requires IAL3 sessions to be attended, with capture on hardware the proofing provider controls. When agencies cannot prove control of the device, camera stack, network path, and capture flow, adversaries exploit the gap to plant operatives, exfiltrate CUI, and compromise mission networks.

Threat landscape

Software-only and BYOD proofing leave missions exposed to infiltration and IP theft

Federal identity proofing is now a security and counter-intelligence problem as well as an onboarding task. Nation-state-backed fake IT worker schemes, proxy interviewing, synthetic identities, and AI-enabled impersonation all raise the cost of relying on unmanaged devices and low-control workflows.

Why uncontrolled devices are a threat

Without controlled hardware, agencies cannot rule out virtual camera injection or AI-deepfakes during the interview, and adversaries exploit the gap to infiltrate mission-critical systems.

Why controlled deployment protects the mission

IAL3 Kits, Office Kiosks, and agency-operated hardware let agencies document chain of custody, operating control, and staffing decisions, giving mission owners verifiable assurance against insider threats and synthetic identities.

Travel-heavy enrollment slows readiness. Applicants wait for facilities, appointments, and local staffing before work can begin.

Fixed-site models miss distributed reality. Contractors, field personnel, and rural workers still need a trusted, controllable proofing path.

BYOH / BYOA adds operational control. Agencies can minimize supply chain risk, ensure max OPSEC, and keep sensitive interviews strictly in-house.

Proofing lifecycle

How attended IAL3 proofing works — from controlled hardware to credential

Every deployment model follows the same NIST SP 800-63A-4 lifecycle, so evidence stays consistent whether hardware is managed, deployed, or government-owned.

Deploy controlled hardware

A pre-configured kit ships to the applicant’s office or home — or agency-furnished equipment is enrolled. Every device is verified before a session can start.

Attended proofing session

A trained agent attends live while the controlled device captures document evidence, NFC chip reads, and biometrics with continuous anti-spoofing.

AAL3 authenticator binding in the same session

While the agent still attends, a phishing-resistant authenticator is bound to the newly proofed identity, as SP 800-63A-4 requires at IAL3. The authenticator is priced separately.

Evidence package sealed

Session artifacts, chain-of-custody records, and control mappings are packaged for ISSO review and Authorizing Official assessment against NIST SP 800-63A-4.

Credential & access decisions

Hand a defensible proofing record to your PIV issuer, IdP, or access program — and re-verify later with step-up proofing when risk changes.

Program coverage

Built for mission-critical federal programs

Support the programs that break under travel bottlenecks, fragmented proofing vendors, low-control BYOD workflows, and the growing threat of nation-state infiltration targeting contractor networks.

Stopping nation-state infiltration and IP theft at the point of entry

Strengthen onboarding before credentials and network access are granted by using supervised proofing, controlled hardware, and evidence that closes infiltration vectors before adversaries gain access to classified systems, CUI, or sensitive research.

DIB and contractor onboarding at scale

Verify systems integrators, subcontractors, and supplier workforce members without forcing every person through a single metro-area or fixed-site credentialing process.

HSPD-12 and PIV support for distributed populations

Support remote and field-based proofing workflows that strengthen identity assurance before credential issuance, especially where traditional enrollment sites create delay.

Step-up verification for recovery, privilege changes, and sensitive access

Use risk-based re-verification when accounts are recovered, privileges are elevated, or high-risk actions require stronger assurance than the original onboarding event.

Deployment models

Choose the operating model that fits your mission and security boundary

One platform, three deployment paths — from fully managed to government-owned and operated. Start with what fits your timeline, then evolve as your program matures.

Fastest start

Managed IAL3 Kit

Trust Swiftly ships, configures, and manages the proofing hardware. Your team focuses on mission execution while we handle device logistics, updates, and support.

Pre-configured device shippedReady to proof on arrival — no IT setup required.
Remote lifecycle managementFirmware, app, and security updates pushed automatically.
Return and redeployDevices rotate between sites as mission needs shift.

Best for pilot programs and distributed contractor onboarding.

Portable deployable identity verification kiosk station for field offices

Field ready

Office Kiosk

Portable, tamper-evident stations for field offices, enrollment centers, and satellite locations. Designed for supervised, high-throughput proofing at the point of need.

Rapid site activationPlug-and-proof at any location with power and network.
Supervised sessionsOn-site agents ensure chain of custody and anti-spoofing compliance.
Portable between locationsMove kiosks as demand shifts across offices and regions.

Best for enrollment centers and high-volume field operations.

Government-operated identity proofing station installed in an agency office

Maximum control

Government-Owned & Operated

Agencies supply their own approved hardware and internal verification agents. Trust Swiftly provides the proofing software, workflow engine, and evidence pipeline.

Agency-supplied hardwareUse your own devices to minimize supply chain risk.
Internal staffing modelYour cleared agents conduct proofing interviews in-house.
Full operational sovereigntyHardware, personnel, and data remain under agency control.

Best for sensitive programs and interviews that need maximum OPSEC.

All three models run on the same platform, produce the same NIST SP 800-63A-4 IAL3 evidence artifacts, and deploy to FedRAMP-authorized cloud infrastructure or on agency-owned systems. Start with Managed IAL3 Kits for a pilot, then transition to Government-Owned & Operated as your program scales. Need people productive sooner? Run instant IAL2 pre-enrollment in parallel while IAL3 kits are in transit — one workflow engine delivers both assurance levels.

The status quo vs. the Trust Swiftly advantage

Three approaches to federal identity proofing — only one keeps PII inside a controlled boundary

Federal buyers need a proofing model that satisfies NIST 800-63, supports Executive Order 14028 (Zero Trust), and deploys without a multi-year ATO cycle.

Capability	Legacy PIV/CAC	Traditional Cloud SaaS	Trust Swiftly
Speed to verify	Weeks to months — hardware-dependent, fixed-site enrollment.	Days, but PII must leave the agency boundary.	IAL2 in minutes; IAL3 as soon as the IAL3 Kit arrives.
Data sovereignty	On-prem but inflexible, hardware-locked, and expensive to scale.	Multi-tenant; biometric PII exits the agency environment.	Runs inside a FedRAMP-authorized cloud or your own boundary, so PII stays under controlled custody.
ATO timeline	Inherited from existing infrastructure, but rigid and slow to adapt.	12–18 months for a new ATO on an external platform.	Can inherit controls from the hosting boundary; the ATO decision stays with the agency.
Anti-spoofing & deepfake defense	In-person reduces deepfake risk, but requires fixed-site enrollment.	Basic liveness on uncontrolled devices — vulnerable to injection.	Continuous anti-spoofing on controlled hardware with supervised sessions.
Deployment coverage	Fixed-site only — remote and field populations are excluded.	BYOD/uncontrolled devices with no hardware assurance.	IAL3 Kits, Office Kiosks, or BYOH/BYOA: one platform for all.
Equitable access	Varies by enrollment office — no standardized accessibility.	Depends on vendor; accessibility varies.	Kit-based proofing at home enables homebound and disabled applicants to verify without traveling to fixed sites.
Supply chain & hardware risk	Proprietary "black-box" hardware with opaque global supply chains and high vendor lock-in.	Uncontrolled BYOD with zero hardware assurance.	Hardware-agnostic. Deploy on fully transparent COTS or agency-owned devices (GFE) for zero supply chain mystery.
Resiliency & maintenance	Fragile, single points of failure. Requires expensive vendor break-fix contracts and extended downtime.	Relies on end-users to troubleshoot their own consumer devices.	Modular components can let internal IT replace approved standard parts through normal maintenance processes.

From pilot to mission-wide deployment, without a custom build

Federal buyers need technology that protects the mission from day one — plus a practical path to evaluate, pilot, procure, and scale from managed deployments into government-owned operational models without standing up a brand-new proofing program.

Start with a pilot to validate workflow, evidence collection, and travel savings before broader deployment.
Expand from IAL3 Kits or Office Kiosks into BYOH/BYOA when agencies want to reuse government-owned hardware and internal staff.
Support agencies, system integrators, and prime contractors that need one NIST SP 800-63A-4 IAL3 proofing model across multiple user populations.
Procure directly or through established government contract vehicles, including GSA Schedule, NASA SEWP, and ITES-SW2.

Reseller or systems integrator? See FedRAMP High IAL3 partnerships. Security reports and company data: security and procurement.

Scope an IAL3 Pilot

GSA Schedule • NASA SEWP • ITES-SW2 • Direct Award
Trust Swiftly • UEI C7SJPE48R338 • CAGE 9JE90
Download the capability statement (PDF) (opens in a new tab)

Buyer questions

Frequently asked by federal buyers

Trust Swiftly federal identity proofing is built for civilian agencies, Department of War (DoW) programs, systems integrators, prime contractors, and suppliers that need NIST SP 800-63A-4 IAL2 and IAL3 identity proofing for distributed users.

Trust Swiftly does not replace CAC or PIV issuance. It strengthens identity proofing before credential issuance and supports remote, distributed, and contractor populations that are difficult to process through a fixed enrollment center.

Trust Swiftly combines supervised workflows with controlled hardware and a Trusted Path, making it harder for proxy operatives, synthetic identities, and AI-deepfakes to infiltrate mission-critical networks.

Yes. Agencies can adopt a Government-Owned & Operated model using their own approved hardware and internal verification agents alongside Trust Swiftly software. This minimizes supply chain risk, ensures maximum operational security, and keeps highly sensitive interviews strictly in-house.

Yes. Trust Swiftly can support step-up proofing for account recovery, privilege changes, and other high-risk events so agencies and contractors are not limited to a one-time proofing decision.

Trust Swiftly supports direct purchasing as well as procurement through established government contract vehicles, including GSA Schedule, NASA SEWP, and ITES-SW2.

Security teams can review workflow design, hardware control, staffing model, chain-of-custody controls, proofing artifacts, retention approach, and how evidence maps to ISSO review requirements and supports counter-infiltration programs.

Trust Swiftly supports deployments inside an agency or contractor security boundary, including FedRAMP-authorized cloud environments. Authorization scope, inherited controls, and boundary decisions remain part of the buyer's ATO package. Trust Swiftly can provide SOC 2 Type II, ISO 27001, workflow design, evidence handling, and control-mapping artifacts for review. As FedRAMP transitions Impact Levels to Classes — FedRAMP High becomes Class D — and introduces 20x automation, Trust Swiftly tracks the evolving baselines so control mappings stay current.

SRIP is the retired NIST 800-63-3 term. NIST SP 800-63A-4 replaced it with attended proofing: the applicant uses hardware the proofing provider controls while a trained agent attends the session, on site or remotely through a device controlled by the proofing provider (NIST calls it the credential service provider, or CSP). Trust Swiftly implements the rev-4 model — agents attend live sessions on controlled, inspected kits at the applicant’s office or home.

Legacy identity kiosks often rely on custom-built, "black-box" hardware with opaque supply chains, which can hide hardware-level vulnerabilities. Trust Swiftly takes a transparent, open-architecture approach. We allow agencies to deploy on vetted Commercial Off-The-Shelf (COTS) devices or government-furnished equipment (GFE), and we share our architecture, including a Software Bill of Materials (SBOM), so your security teams can see how and where PII is processed.

Proprietary kiosks can be difficult to maintain when custom peripherals fail or vendor support is required. Trust Swiftly’s modular model decouples the proofing workflow from specialized hardware where possible, so approved COTS or government-furnished components can be replaced through normal IT processes. This reduces vendor lock-in and gives agencies more operational flexibility.

For Class D (High), FedRAMP's 2026 Rev5 control guidance says authenticators must comply with the most recent NIST Digital Identity Guidelines at IAL, AAL and FAL level 3, so the users in scope need IAL3 identity proofing. FedRAMP High Rev. 5 IAL3 Requirements gives the full answer, control by control.

No, as of October 2026. NIST publishes the IAL3 requirements in SP 800-63A-4 but states that it does not conduct certification or conformity assessment against them; agencies and assessors evaluate each provider directly. We give your assessor the IAL3 conformance mapping under NDA and a signed evidence package for every session.

Federal Identity Proofing Resources

Go deeper on NIST SP 800-63A-4 IAL3 proofing, FedRAMP High deployment, and counter-infiltration strategy with research and guidance from the Trust Swiftly team.

FedRAMP High IAL3 Implementation Guide for Distributed Teams

FedRAMP High Rev. 5 IAL3 Requirements in 2026

Modernizing Government Credentialing: 11 Strategic Benefits of IAL3 at the Office or Home

Securing the Federal Supply Chain with IAL3 Identity Proofing

NIST IAL3 Kiosks: On-Site Attended Proofing on Controlled Kiosks

How to Reduce Nation-State and Proxy-Hire Risk in Remote IT Teams

IAL3 Best Practices: How to Evaluate an Identity Proofing Solution

NIST IAL3 Verification & Proofing: Platform Capabilities

Next step

Modernize identity proofing before infiltration, IP theft, or remote fraud compromises your mission

If your team is evaluating NIST SP 800-63A-4 IAL3 proofing, a FedRAMP High (Class D) deployment, or a BYOH / BYOA operating model, we can help you compare options, shape a pilot, and map the right buying path.

Talk to an IAL3 Specialist Compare IAL3 Approaches