Last reviewed October 22, 2026 against the final NIST SP 800-63-4.
Identity Assurance Level 3 (IAL3) is the highest of the three identity assurance levels in NIST's Digital Identity Guidelines, SP 800-63-4. It is the level for access where a false identity would do the most harm, such as administrators of federal cloud systems.
IAL3 asks for the same identity evidence as IAL2. What it adds is how the session runs: a trained proofing agent attends it on-site, on equipment the provider controls, and a biometric is collected and kept.
The three identity assurance levels
| Level | What NIST requires | How it can be delivered |
|---|---|---|
| IAL1 | Core attributes validated against authoritative or credible sources, with steps to tie them to the applicant (§1.2) | Any proofing type, remote or on-site, attended or not (§4.1.1) |
| IAL2 | More evidence and more rigorous validation, including confirming the applicant owns the evidence (§4.2) | Any proofing type, remote or on-site, attended or not (§4.2.1) |
| IAL3 | A trained proofing agent interacts directly with the applicant in an on-site attended session, and at least one biometric is collected (§4.3) | On-site attended only (§4.3.1) |
What IAL3 requires
NIST states the core rule in one sentence:
“IAL3 identity proofing SHALL only be delivered as on-site attended. The proofing agent MAY be co-located with the applicant or attend the identity proofing session via a CSP-controlled kiosk or device.” (SP 800-63A-4 §4.3.1)
The rest of section 4.3 builds on it:
- Evidence (§4.3.2): one SUPERIOR piece, two STRONG pieces, or one STRONG plus one FAIR.
- A retained biometric (§4.3.3): the provider “SHALL collect and retain a biometric sample” to support account recovery and non-repudiation.
- Evidence validation (§4.3.4): SUPERIOR evidence, such as a passport chip, is validated cryptographically. FAIR and STRONG evidence may be validated by scanning technology or by a trained agent's visual or physical inspection.
- The setting (§4.3.7, §4.3.8): a secure physical setting, provider-supplied sensors, and agents trained to spot manipulation and coercion. When the agent attends by video, the kiosk or device must be provider-controlled, protected against tampering and inspected by trained technicians.
- The first authenticator (§4.3.10): issued or enrolled during the attended interaction.
For a control-by-control checklist, see the SP 800-63-4 IAL3 conformance criteria.
IAL2 vs IAL3
The evidence rules are identical: sections 4.2.2 and 4.3.2 ask for the same combinations. The differences are all in how the session runs.
| Requirement | IAL2 | IAL3 |
|---|---|---|
| Evidence | SUPERIOR, or 2 STRONG, or STRONG + FAIR | The same |
| Where | Remote or on-site | On-site attended only |
| Whose device | The applicant's own device is allowed | Provider-controlled kiosk or device only |
| Proofing agent | Optional | Required, in the room or attending through the controlled device |
| Biometric | Optional (several pathways) | Collected and retained |
| First authenticator | May be enrolled remotely, including one the subscriber provides | Issued or enrolled during the attended interaction |
The four proofing types
SP 800-63A-4 (§2.1.3) sorts proofing by where it happens and whether an agent attends. Only one of the four can reach IAL3.
| Where | Unattended | Attended |
|---|---|---|
| Remote (the applicant's own location and devices) | IAL1, IAL2 | IAL1, IAL2 |
| On-site (a provider-controlled location and devices) | IAL1, IAL2 | IAL1, IAL2, IAL3 |
“Remote attended” proofing is a video session on devices the provider does not control. It can reach IAL2 but not IAL3. Earlier revisions of the guidelines called the kiosk-based, agent-by-video model “supervised remote identity proofing”; revision 4 treats it as on-site attended proofing. How an attended IAL3 session works walks through one.
Does FedRAMP High require IAL3?
Yes. FedRAMP's 2026 Rev5 control guidance says Class D (High) authenticators “must be compliant with the most recent NIST Digital Identity Guidelines IAL, AAL, FAL level 3” (fedramp.gov). See FedRAMP High Rev. 5 IAL3 Requirements for the control text and what an assessor looks for.
Frequently asked questions
Can IAL3 run on my own phone or laptop?
No. IAL3 is on-site attended, on a location and devices the provider controls. A video call on your own device is remote attended proofing, which tops out at IAL2.
Does the proofing agent have to be in the room?
No. The agent may be co-located or attend through a provider-controlled kiosk or device (Section 4.3.1). That is how IAL3 can happen at an office or a home office without travel: the provider ships or installs the controlled equipment and the agent attends by video.
Is IAL3 the same as IAL2 done in person?
No. An in-person IAL2 session doesn't have to meet IAL3's requirements for the setting and the agent (Section 4.3.7), the retained biometric or the attended authenticator binding.
Is there an IAL3 certification?
NIST publishes the requirements; it doesn't certify, accredit or list IAL3 providers. A provider shows how it meets them through its documented practice statement (Section 3.1), independent testing of its biometric and evidence-validation technology (Sections 3.11 and 3.13), and the review your agency or assessor carries out. Trust Swiftly shares a control-by-control conformance mapping under NDA.
How long does an IAL3 session take?
Typically 3 to 10 minutes once the kit or kiosk is in place.
How long is the biometric kept?
NIST requires it to be retained, with a retention period that follows applicable regulations, policies and statutes (Section 3.11). With Trust Swiftly, each customer sets the retention period for its own program. See IAL3 evidence retention and re-verification.