NIST IAL3 Glossary: Identity Proofing and FedRAMP Terms

Last reviewed October 22, 2026 against NIST SP 800-63-4 and FedRAMP's 2026 rules.

These are the terms that come up when a team plans NIST IAL3 identity proofing for FedRAMP High (Class D). Each definition follows its source, which is linked below it. For the full explainer, start with What Is NIST IAL3?

Identity assurance levels

Identity assurance level (IAL)

NIST's measure of confidence that a person's claimed identity is their real identity. SP 800-63A-4 defines three levels, IAL1, IAL2 and IAL3, and each builds on the requirements of the level below to give more assurance. Companion scales rate authentication (AAL) and federation (FAL).

Source: NIST SP 800-63A-4 §1.2

IAL1

The lowest identity assurance level. All core attributes are validated against authoritative or credible sources, with steps to confirm they belong to the applicant. Proofing can be remote or on-site, with or without a CSP representative attending. NIST designs IAL1 to limit highly scalable attacks and to protect against synthetic identities and the use of compromised personal information.

Source: NIST SP 800-63A-4 §1.2

IAL2

Adds more evidence and more rigorous validation and verification to IAL1, including confirming that the applicant is the rightful owner of the evidence. It can be delivered remotely or on-site, attended or unattended, with or without biometrics. NIST designs IAL2 to limit scaled and targeted attacks and to protect against basic evidence falsification, evidence theft and social engineering.

Source: NIST SP 800-63A-4 §1.2 and §4.2

IAL3

The highest identity assurance level in SP 800-63A-4. It keeps the IAL2 evidence rules and adds an on-site attended session, in which a trained proofing agent interacts directly with the applicant, and a biometric that is collected and retained. The agent may be in the room or attend through a CSP-controlled kiosk or device. The full explainer is What Is NIST IAL3?

Source: NIST SP 800-63A-4 §4.3 and §4.3.1

Authentication assurance level (AAL) and AAL3

NIST's measure of how strongly a sign-in proves that the claimant controls authenticators bound to the subscriber account, from AAL1 to AAL3 (SP 800-63B-4). AAL3 gives very high confidence: it requires a phishing-resistant cryptographic authenticator with a non-exportable private key, so syncable authenticators, whose keys are copied to the cloud, cannot be used.

Source: NIST SP 800-63B-4 §2.3 and Appendix B

Federation assurance level (FAL)

NIST's measure of how securely a federated sign-in passes authentication and attribute information from an identity provider to a relying party, from FAL1 to FAL3 (SP 800-63C-4). At FAL3 the relying party must also verify that the subscriber controls an authenticator, through a holder-of-key assertion or a bound authenticator, which protects against a compromised identity provider.

Source: NIST SP 800-63C-4 §2 and §2.4

Proofing types and settings

Identity proofing

The process of collecting, validating and verifying information about a person to establish confidence in their claimed identity. SP 800-63A-4 sets out three steps: resolution (collecting evidence and attributes to single out a unique, real person), validation (confirming they are authentic, accurate and valid) and verification (confirming the applicant is the person the evidence was issued to).

Source: NIST SP 800-63A-4 §2.1

On-site attended proofing

Identity proofing in a physical setting where the applicant completes resolution, validation and verification in the presence of a proofing agent or trusted referee, who may be co-located or interact through a kiosk or device. The CSP controls the physical location and devices. It is the only proofing type SP 800-63A-4 allows at IAL3.

Source: NIST SP 800-63A-4 §2.1.3 and §4.3.1

Kiosk-based proofing

On-site attended proofing in which the applicant uses a CSP-controlled kiosk or device while the proofing agent attends remotely over high-resolution video. The agent must take part in evidence collection, validation and verification, and the devices must be tamper-protected and periodically inspected by trained technicians. Trust Swiftly's IAL3 Kits and kiosks are devices of this kind.

Source: NIST SP 800-63A-4 §4.3.8

Remote attended proofing

Identity proofing in which the applicant completes resolution, validation and verification through a secure video session with a proofing agent or trusted referee, on a location and devices the CSP does not control, such as the applicant's own phone or computer. Under SP 800-63A-4 it supports IAL2 at most; IAL3 must be delivered on-site attended (§2.1.3, §4.3.1).

Source: NIST SP 800-63A-4 §2.1.3 (Identity Proofing Types) and §4.3.1

Supervised remote identity proofing (SRIP)

Earlier revisions of SP 800-63A called this model supervised remote identity proofing: an applicant uses a CSP-controlled kiosk or device while a proofing agent attends remotely over video. SP 800-63A-4 replaced the term. The same model is now kiosk-based on-site attended proofing (§4.3.8), one of the two ways IAL3 can be delivered.

Source: NIST SP 800-63A-4 §4.3.8

Roles in identity proofing

Credential service provider (CSP)

A trusted entity that identity-proofs applicants and registers authenticators to their subscriber accounts; it may be an independent third party. SP 800-63A-4 writes its proofing requirements as CSP responsibilities, which one entity or several component services can meet. In FedRAMP's rules, CSP stands for cloud service provider, a different role.

Source: NIST SP 800-63A-4 Appendix C and §2; FedRAMP Definitions FRD-PRV

Proofing agent

A vetted, trained agent of the CSP who attends identity proofing sessions and makes limited, risk-based decisions, such as inspecting identity evidence and comparing the applicant with it. At IAL3 the agent interacts directly with the applicant and must be trained to spot manipulation, coercion and social engineering during the session.

Source: NIST SP 800-63A-4 §2.1.2, §1.2 and §4.3.7

Trusted referee

A vetted, trained agent of the CSP, a third-party service or the relying party who makes risk-based decisions when an applicant cannot meet the usual requirements of an IAL, for example because they lack the required evidence or the attributes on it do not match after a recent name change. Trusted referees receive more training than proofing agents.

Source: NIST SP 800-63A-4 §2.1.2

Relying party (RP)

An entity that relies on a verifier's assertion of a subscriber's identity, typically to process a transaction or grant access to information or a system. Under SP 800-63C-4, the relying party decides the minimum IAL, AAL and FAL it will accept and checks that they are met before granting access.

Source: NIST SP 800-63A-4 Appendix C; SP 800-63C-4 §2.5

Independent assessor

FedRAMP's term for a FedRAMP Recognized independent assessment service, formerly called a Third-Party Assessment Organization, or 3PAO. Contracted by the cloud provider, it verifies and validates the provider's security materials and operations and attests to their quality for FedRAMP Certification. Assessors reviewing a package that relies on Trust Swiftly for IAL3 can request its conformance mapping under NDA.

Source: FedRAMP Consolidated Rules for 2026: Independent Assessment Service Responsibilities

Evidence, biometrics and authenticators

SUPERIOR, STRONG and FAIR evidence

NIST's three grades of identity evidence, set by the rigor of its issuance and how well it supports validation and verification. SUPERIOR evidence, such as a passport or PIV card, carries issuer-signed data checked cryptographically; a driver's license is STRONG; a corporate ID is FAIR. IAL2 and IAL3 require one SUPERIOR, two STRONG, or one STRONG plus one FAIR.

Source: NIST SP 800-63A-4 §2.4.1, §4.3.2 and Appendix A

Biometric sample retention at IAL3

At IAL3 the CSP must collect and retain a biometric sample, such as a facial image or fingerprint, during proofing. NIST gives three reasons: account recovery, non-repudiation, and confidence that the same person is present at proofing and at issuance if those happen separately. The CSP must also obtain consent and publish its retention period and deletion process.

Source: NIST SP 800-63A-4 §4.3.3 and §3.11

Authenticator binding

Linking an authenticator to a subscriber account so it can be used to authenticate as that subscriber. At IAL3 the CSP must distribute or enroll the subscriber's first authenticator during the on-site attended interaction with a proofing agent; if this happens outside a single authenticated protected session, a biometric comparison against the proofing sample must come first.

Source: NIST SP 800-63A-4 §4.3.10; SP 800-63B-4 §4.1

Notification of proofing

A notice the CSP must send after successful proofing, naming the identity service and the date and explaining what to do if the person did not take part. It must go to a validated postal address or phone number (a validated email address is allowed only at IAL1), and at IAL2 and IAL3 NIST recommends the postal address.

Source: NIST SP 800-63A-4 §3.10 and §4.3.9

FedRAMP and federal terms

FedRAMP Class D

The highest of FedRAMP's four Certification Classes (A to D) under its 2026 rules. The classes loosely align with the older Low, Moderate and High impact levels, and FedRAMP refers to legacy Rev5 Class D (High) packages, hence the shorthand FedRAMP High (Class D). FedRAMP's Rev5 guidance requires Class D authenticators to comply with IAL, AAL and FAL level 3 of the latest NIST Digital Identity Guidelines.

Source: FedRAMP Consolidated Rules for 2026: Rev5 IA-5 guidance (Class D); Definitions FRD-CCL; Choosing a Class

FedRAMP 20x

FedRAMP's modern certification type, new in 2026, based mainly on measured outcomes expressed as Key Security Indicators. The legacy Rev5 type, based mainly on documented plans, is currently the only route to Class D. FedRAMP expects to pilot 20x Class D in late 2026 and offer it formally in early 2027.

Source: FedRAMP Consolidated Rules for 2026: Choosing a Certification Type; Definitions FRD-CTY

Key Security Indicator (KSI)

In FedRAMP 20x, a security capability that a cloud provider demonstrates and measures, giving measurable validation that its protections work in operation. Each KSI lists related NIST SP 800-53 controls; KSI-IAM-AAM, Automating Account Management, lists IA-12 identity proofing and its enhancements (2), (3) and (5) among them. RFC-0036 proposes KSI-IAM-MPI for 20x Class D, with IA-12(4) in-person validation and verification as a related control.

Source: FedRAMP Consolidated Rules for 2026: Key Security Indicators; KSI-IAM-AAM

Security Decision Record (SDR)

FedRAMP's persistently maintained, verified and validated record of the security decisions a provider makes over the life of a cloud service offering. It replaces the traditional System Security Plan and documents how FedRAMP Practices are addressed: implementation rationale, resulting customer risk, assessment findings and supporting artifacts, including those for each Key Security Indicator.

Source: FedRAMP Consolidated Rules for 2026: Definitions FRD-SDR; Key Security Indicators

IA-12 (Identity Proofing)

The NIST SP 800-53 Rev. 5 identity proofing control: identity-proof users who need accounts for logical access at the appropriate identity assurance level, resolve each identity to a unique individual, and collect, validate and verify identity evidence. FedRAMP's Rev5 baselines include IA-12 at Classes C and D; enhancement IA-12(4), in-person validation and verification, applies only at Class D.

Source: NIST SP 800-53 Rev. 5 IA-12, as published in FedRAMP's 2026 reference catalog with Rev5 baselines

PIV and HSPD-12

Personal Identity Verification (PIV) is the federal employee and contractor credential system defined in FIPS 201-3 to meet Homeland Security Presidential Directive 12 (HSPD-12), the 2004 directive that set a common identification standard. FIPS 201-3 says PIV card identity proofing and registration meet IAL3 because they follow a tailored process based on SP 800-63A IAL3 requirements.

Source: NIST FIPS 201-3 §1.2 and §2.7