Identity Assurance Levels (IAL)

The Identity Assurance Levels (IALs) defined by NIST Special Publication 800-63A describe the degree of confidence that a person claiming an identity is the correct individual. The three levels represent increasing rigor in identity verification.

IAL1 – Self-asserted identity

• No identity proofing is required.

• Attributes may be collected but are not verified.

• Suitable for use cases where linking to a real-world identity is unnecessary.

IAL2 – Verified identity (remote or in-person)

• Requires evidence of the claimed identity, which can be verified either remotely or in person.

• Acceptable combinations include one piece of strong evidence OR two pieces of fair evidence.

• Validation (checking the integrity of the evidence) and verification (confirming the evidence matches the claimed identity) are strongly recommended but not strictly required.

• Biometric comparison (e.g, selfie to ID) and liveness detection are optional but commonly used to strengthen assurance.

• Supervised remote verification is allowed but not required.

IAL3 – Supervised high-assurance identity verification

• Requires in-person or supervised remote identity proofing conducted by a trained and authorized representative.

• Requires either two pieces of strong evidence OR one piece of superior evidence (e.g., an ePassport with cryptographic verification).

• The applicant must be physically or virtually present under live supervision.

• Biometric comparison is required — the individual’s biometric (e.g., a face or fingerprint scan) must be collected and compared to the biometric data on their identity evidence (e.g., photo on ID).

• Includes strict chain-of-custody procedures, anti-spoofing protections, and detailed auditing.

• Suitable for high-risk use cases that demand the highest level of confidence in the identity asserted.