SP 800-63-4Final2025

Digital Identity Guidelines

At a glanceThe umbrella volume of NIST's digital identity guidance, covering identity proofing, authentication and federation (single sign-on). It explains how to choose assurance levels based on risk. Read it with SP 800-63B when designing staff, student or family sign-in.

Reading level: Technical
Length: 96 pages · about 40 min for the key parts
Best for: Technology directors, IT staff and service partners
CSF 2.0: Protect, Govern

Read it on NIST DOI 10.6028/NIST.SP.800-63-4 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

SP 800-63-4 sets out the digital identity model and a risk process for selecting identity, authentication and federation assurance levels. Requirements live in three companions: 63A (identity proofing and enrollment), 63B (authentication) and 63C (federation and assertions, the basis of single sign-on).

How it is organized

Digital identity model: subjects, credential providers, verifiers, relying parties, identity providers, wallets
Digital identity risk management: impact assessment, selecting IAL, AAL and FAL, tailoring, continuous evaluation
Companions: SP 800-63A-4 (proofing), SP 800-63B-4 (authentication), SP 800-63C-4 (federation)

What a school district should take from it

Different users need different assurance: an administrator account warrants more than a family portal login.
Single sign-on concentrates risk in the identity provider, so protect it with strong MFA and monitoring.

How to use it in your district

Classify district accounts (administrators, staff, students, families, vendors) and the assurance each needs.
Protect the single sign-on identity provider as the district's most critical account system.
Review how new staff and students are enrolled and how accounts are removed when people leave.

Common misconceptions

Identity guidance is only about passwords.: It also covers proving who someone is at enrollment and how sign-in is shared across applications.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

PR.AAIdentity Management, Authentication, and Access Control

Tools in the program portal

Team and accessNamed accounts, roles and authenticator MFA
Guide: MFA for K-12, a practical rolloutPublic guide
Evidence collection kitsCollect configuration evidence from Microsoft 365, Google and more

Related publications

SP 800-63B-4Passwords, MFA and passkeys
SP 800-207Zero trust architecture

Citation and source

SP 800-63-4, Digital Identity Guidelines. National Institute of Standards and Technology. 2025. https://doi.org/10.6028/NIST.SP.800-63-4.

Replaces: SP 800-63-3 (2017).

Topics: Identity, passwords and MFA. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.