Identity assurance levels describe how confident a service can be that a person really is who they claimed to be when their account was created. The best-known scheme comes from NIST SP 800-63, the US digital identity guidelines, which define levels known as IAL1, IAL2 and IAL3.
This article explains what each level means in plain terms, how identity assurance differs from the related authentication and federation levels, and how organizations decide which level a service needs. It also compares the NIST approach with other schemes and explains what assurance levels mean for ordinary people applying for accounts.
Not Every Account Needs the Same Certainty
Imagine three online services: a recipe forum, a utility billing portal and a system that lets people view their medical records. If an impostor registered on the forum under a false name, little harm would follow. If they took over a medical record, the damage to privacy and safety could be severe.
Applying the strictest checks everywhere would be expensive and would exclude many legitimate users. Applying the weakest checks everywhere would expose sensitive services to fraud. Assurance levels offer a structured middle path, matching the depth of identity proofing to the consequences of getting it wrong.
The idea is simple, yet putting it into practice requires discipline. Organizations must assess risk honestly, choose a level, and then implement every requirement of that level rather than selecting only the convenient parts. A partial implementation can create a false sense of confidence that is worse than none.
Three Kinds of Assurance in One Framework
NIST SP 800-63 separates digital identity into three distinct questions, each with its own levels. Identity assurance, written IAL, covers how strongly the applicant’s real identity was established during proofing. This article focuses on that first question.
Authenticator assurance, written AAL, covers how strongly the person proves control of their account each time they log in, such as with a password plus a second factor or a phishing-resistant passkey. Federation assurance, written FAL, covers how securely identity information is passed between an identity provider and a relying service.
The three dimensions are independent. A service might need strong proofing but only moderate login strength, or the reverse. Treating them separately lets organizations match each control to its own risk, rather than assuming that a strong login compensates for weak proofing or vice versa.
The NIST Identity Assurance Levels at a Glance
NIST describes three identity assurance levels, each adding stronger requirements. Details have changed between revisions of the guidelines, so the summaries below describe the general intent rather than every specific rule. Readers implementing them should work from the current published text.
IAL1
IAL1 is the lowest level. In earlier revisions it allowed attributes to be self-asserted, meaning the service did not need to link the applicant to a real-world identity. The latest revision introduces lighter proofing requirements at this level and treats services needing no proofing as a separate case. IAL1 suits services where impersonation would cause limited harm.
IAL2
IAL2 requires evidence that supports the real-world existence of the claimed identity and checks that the applicant is genuinely associated with it. Proofing may be performed remotely or in person, using validated documents or records and a verification step such as face comparison. Many government and financial services operate at this level.
IAL3
IAL3 is the highest level. It requires physical presence, either in person or through a tightly controlled supervised remote session, with an authorized representative examining strong evidence. Biometric information is typically collected to support later checks. IAL3 suits services where impersonation could cause serious harm to people, organizations or national interests.
What Changes as the Level Rises
Moving from one level to the next is not just a matter of adding one more check. Several aspects of proofing tighten together, which increases confidence but also cost, effort and data collection. The main differences across levels are summarized below.
- Evidence strength: higher levels require documents and records issued under stricter processes.
- Validation depth: evidence must be checked more rigorously, often with the issuer or through cryptographic checks.
- Verification method: binding the applicant to the evidence becomes stricter, moving toward supervised or physical presence.
- Record keeping: higher levels require more detailed records of how proofing was performed.
- Fraud controls: expectations for detecting and handling suspicious applications increase.
Because requirements rise together, organizations should avoid choosing a level higher than needed. Each step up adds friction and excludes some legitimate applicants who lack the required evidence or cannot attend in person. Over-assurance has costs just as under-assurance does.
Choosing a Level Through Risk Assessment
NIST frames level selection as part of a digital identity risk assessment. The organization considers what could go wrong if an impostor were enrolled and how serious each consequence would be. A typical assessment follows a sequence like the one below.
- Describe the service, its users and the transactions it supports.
- Identify the harms that could result from a proofing failure, such as financial loss, privacy exposure or safety risks.
- Rate the likelihood and impact of each harm, considering who would be affected.
- Select an initial assurance level that addresses the most serious realistic harms.
- Adjust for user needs, available evidence and compensating controls, documenting each decision.
The documentation step matters. Auditors, partners and future team members need to understand why a level was chosen and which risks were accepted. A written rationale also makes it easier to revisit the decision when the service or the threat landscape changes.
Assurance Levels Outside the United States
Other regions use comparable but distinct schemes. Under the EU eIDAS regulation, electronic identification schemes are classified at levels of assurance labeled low, substantial and high. These levels cover enrollment, credential management and authentication together rather than separating them as NIST does.
Many national digital identity programs define their own levels, often inspired by NIST or eIDAS but adapted to local documents, laws and infrastructure. Some countries publish good practice guides that describe how evidence strength and verification methods combine to reach each level.
Mapping between schemes is rarely exact. A level in one framework may correspond only partly to a level in another because of differences in evidence types or in how authentication is handled. Organizations operating across borders should consult each relevant authority rather than assuming direct equivalence.
Common Misunderstandings About Assurance Levels
One frequent misunderstanding is that assurance levels describe the user rather than the process. A person is not an IAL2 person; their account was proofed to IAL2 by a particular provider. If they register elsewhere with weaker checks, that second account carries lower assurance.
Another is that a higher level means fraud is impossible. Assurance levels reduce risk by raising the effort required to impersonate someone, but determined attackers, insider abuse and process errors can still cause failures. Monitoring, fraud detection and incident response remain necessary at every level.
A third is treating the level as a one-time label. Proofing evidence can expire, and circumstances change. Some services need to re-verify users after major account changes, long inactivity or signs of compromise, and their policies should describe when and how this happens.
Balancing Assurance With Access and Privacy
Higher assurance usually means collecting more personal data, including document images and sometimes biometric samples. That data must be protected, retained only as long as necessary and used only for its stated purpose. Biometric data in particular is regulated closely, for example as a special category under GDPR.
Access is the other side of the balance. People without standard documents, without smartphones or with disabilities may struggle to meet higher-level requirements. Frameworks increasingly recognize this by allowing alternatives such as trusted referees, who are trained individuals able to vouch for applicants using other evidence.
A well-designed service states its assurance level clearly, explains what applicants will need, and offers supported routes for those who face barriers. That transparency builds trust and helps people prepare, rather than discovering requirements partway through a stressful application process.
A Tiered Service Example
Consider a hypothetical state transport agency offering online services. Checking the status of a public vehicle record requires no account at all. Paying a parking fine needs only a basic account, so the agency accepts lower assurance and focuses on payment security.
Renewing a driver’s license online involves personal data and an official document, so the agency requires proofing at a level comparable to IAL2, using remote document capture and face comparison with an in-person fallback. Users upgrade their existing account rather than creating a new one.
Staff accounts that can change licensing records require the highest assurance, with in-person proofing and strong authenticators. By tiering requirements, the agency keeps everyday tasks simple while protecting sensitive functions, and each decision is recorded in its risk assessment.
What Assurance Levels Mean for You
For everyday users, assurance levels explain why different services ask for different things. A simple app may accept an email address, while a tax portal asks for documents and a selfie. The difference reflects the risk each service manages, not arbitrary bureaucracy.
When a service asks for more evidence than seems reasonable, it is fair to ask why. Legitimate organizations should be able to explain what level they require and how they protect the data collected. Unexplained demands for full documents from low-risk services deserve caution.
Keeping your documents current, knowing where your official records are, and understanding the alternatives available for people without standard evidence will make higher-assurance processes smoother when you need them for benefits, healthcare or financial services.
Keeping Assurance Decisions Up to Date
Assurance requirements are not fixed. NIST revises its guidelines, the EU continues to develop the European Digital Identity Wallet framework, and national programs update their schemes. Each revision can change what evidence is accepted and how verification must be performed.
Organizations should schedule regular reviews of their assurance decisions, triggered both by calendar dates and by events such as new fraud patterns, service changes or updated guidance. Reviews should check whether the chosen level is still appropriate and whether implementation still meets every requirement.
Looking ahead, verifiable credentials and mobile identity documents may let users carry high-assurance proofing results between services. Preparing to accept such credentials, while keeping clear records of assurance levels, will help organizations offer strong protection with less repeated effort for their users.