Digital Identity Guidelines: Authentication and Authenticator Management

Key concepts

The volume defines three authenticator assurance levels (AAL1-AAL3) and the acceptable authenticator types: passwords, one-time codes, out-of-band devices and cryptographic keys including passkeys. It also covers binding authenticators to accounts, recovery when they are lost, and session management. Synced passkeys guidance, previously a supplement, is now Appendix B.

• Password-only sign-in: at least 15 characters; with MFA: at least 8; allow at least 64
• No composition rules and no scheduled password changes; force a change on evidence of compromise
• Block common and breached passwords; allow password managers and paste
• AAL2 systems must offer at least one phishing-resistant option; SMS and voice codes are 'restricted'

How it is organized

• Authentication assurance levels (AAL1, AAL2, AAL3)
• Authenticator and verifier requirements, including phishing resistance and rate limiting
• Authenticator lifecycle: binding, loss, recovery, expiration, revocation
• Session management and reauthentication
• Threats, privacy and customer experience considerations
• Appendix A: password strength; Appendix B: syncable authenticators (passkeys)

What a school district should take from it

• Old district password rules (90-day changes, required symbols) conflict with current NIST guidance.
• Staff accounts with access to student records, finance or administration should use MFA, ideally phishing-resistant.
• Account recovery is part of security: a help desk reset that skips identity checks undoes MFA.

How to use it in your district

1. Update the password standard: length over complexity, a breached-password check, no scheduled expiry.
2. Require MFA for administrators, finance and anyone with student information system access first, then all staff.
3. Prefer authenticator apps, security keys or passkeys over text-message codes for privileged accounts.
4. Write a help desk procedure for verifying identity before resetting passwords or MFA.
5. Allow password managers and turn on paste in sign-in forms you control.

Common misconceptions

Complex passwords that change every 90 days are the safest.

NIST now recommends long passwords, no composition rules and no scheduled changes unless there is evidence of compromise.

Any MFA stops phishing.

Codes sent by text or typed from an app can be phished. Passkeys and security keys are phishing-resistant.

These rules only bind federal agencies.

They are written for federal systems, but they are the most widely used reference for password and MFA policy.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

• PR.AAIdentity Management, Authentication, and Access Control

Tools in the program portal

• Guide: MFA for K-12, a practical rolloutPublic guide
• Team and accessNamed accounts, roles and authenticator MFA
• Evidence collection kitsCollect configuration evidence from Microsoft 365, Google and more
• Policy BuilderDraft policy language tied to rubric categories

Related publications

• SP 800-63-4Digital identity guidelines
• SP 800-207Zero trust architecture