CLAIMBOUND / SOURCE-PUBLICATION EVIDENCE
Digital identity
Every card identifies what it proves, what it does not prove, its exact quote, locator, source hash, and local rerun command.
1. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 10
Narrow public claim
Preface This publication and its companion volumes — [SP800-63A], [SP800-63B], and [SP800-63C] — provide technical and process guidelines to organizations for the implementation of digital identity services.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 10- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Preface This publication and its companion volumes — [SP800-63A], [SP800-63B], and [SP800-63C] — provide technical and process guidelines to organizations for the implementation of digital identity services.
2. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 11
Narrow public claim
When confidence in a person’s real-life identity is not required to provide access to an online service, organizations can use anonymous or pseudonymous accounts.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 11- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
When confidence in a person’s real-life identity is not required to provide access to an online service, organizations can use anonymous or pseudonymous accounts.
3. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 11
Narrow public claim
In all other use cases, a digital identity is intended to establish trust between the holder of the digital identity and the person, organization, or system interacting with the online service.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 11- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In all other use cases, a digital identity is intended to establish trust between the holder of the digital identity and the person, organization, or system interacting with the online service.
4. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 12
Narrow public claim
The composition, models, and availability of identity services have significantly changed since the first version of SP 800-63 was released, as have the considerations and challenges of deploying secure, private, and usable services to users.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 12- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The composition, models, and availability of identity services have significantly changed since the first version of SP 800-63 was released, as have the considerations and challenges of deploying secure, private, and usable services to users.
5. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 12
Narrow public claim
Additionally, this publication provides instruction for credential service providers (CSPs), verifiers, and relying parties (RPs), to supplement the NIST Risk Management Framework [NISTRMF] and its component publications.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 12- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Additionally, this publication provides instruction for credential service providers (CSPs), verifiers, and relying parties (RPs), to supplement the NIST Risk Management Framework [NISTRMF] and its component publications.
6. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 13
Narrow public claim
Online services not covered by these guidelines include those associated with national security systems as defined in [44 U.S.C. § 3552(b)(6)].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 13- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Online services not covered by these guidelines include those associated with national security systems as defined in [44 U.S.C. § 3552(b)(6)].
7. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 13
Narrow public claim
SP 800-63 is organized as the following suite of volumes: • SP 800-63 Digital Identity Guidelines describes the digital identity models, risk assessment methodology, and processes for selecting assurance levels for identity proofing, authentication, and federation.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 13- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SP 800-63 is organized as the following suite of volumes: • SP 800-63 Digital Identity Guidelines describes the digital identity models, risk assessment methodology, and processes for selecting assurance levels for identity proofing, authentication, and federation.
8. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 14
Narrow public claim
SP 800-63A contains both normative and informative material. • [SP800-63B] provides requirements for authentication processes that can be used at each of the three AALs, including choices of authenticators.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 14- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SP 800-63A contains both normative and informative material. • [SP800-63B] provides requirements for authentication processes that can be used at each of the three AALs, including choices of authenticators.
9. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 14
Narrow public claim
SP 800-63B contains both normative and informative material. • [SP800-63C] provides requirements on the use of federated identity architectures and assertions to convey the results of authentication processes and relevant identity information to an organization’s application.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 14- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SP 800-63B contains both normative and informative material. • [SP800-63C] provides requirements on the use of federated identity architectures and assertions to convey the results of authentication processes and relevant identity information to an organization’s application.
10. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 15
Narrow public claim
Federal agencies implementing these guidelines are required to meet statutory responsibilities, including those under the Federal Information Security Modernization Act (FISMA) of 2014 [FISMA] and related NIST standards and guidelines.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 15- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t01_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Federal agencies implementing these guidelines are required to meet statutory responsibilities, including those under the Federal Information Security Modernization Act (FISMA) of 2014 [FISMA] and related NIST standards and guidelines.
11. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 15
Narrow public claim
FISMA requires federal agencies to implement appropriate controls to protect federal information and information systems from unauthorized access, use, disclosure, disruption, or modification.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 15- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
FISMA requires federal agencies to implement appropriate controls to protect federal information and information systems from unauthorized access, use, disclosure, disruption, or modification.
12. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 16
Narrow public claim
Organizations need to demonstrate how organizational privacy policies and system privacy requirements have been implemented in their systems.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 16- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Organizations need to demonstrate how organizational privacy policies and system privacy requirements have been implemented in their systems.
13. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 16
Narrow public claim
Customer Experience It is essential that these guidelines provide organizations with the ability to create modern, streamlined, and responsive customer experiences.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 16- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Customer Experience It is essential that these guidelines provide organizations with the ability to create modern, streamlined, and responsive customer experiences.
14. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 17
Narrow public claim
Establishing a continuous evaluation program provides organizations with the ability to evaluate how well they are mitigating risks and meeting the needs of their users.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 17- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Establishing a continuous evaluation program provides organizations with the ability to evaluate how well they are mitigating risks and meeting the needs of their users.
15. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 17
Narrow public claim
Through metrics and crossfunctional assessment programs, this guideline sets a foundation for a data-driven approach to providing effective, modern solutions that support organizations’ extensive user populations.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 17- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Through metrics and crossfunctional assessment programs, this guideline sets a foundation for a data-driven approach to providing effective, modern solutions that support organizations’ extensive user populations.
16. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 18
Narrow public claim
Notations This guideline uses the following typographical conventions in text: • Specific terms in CAPITALS represent normative requirements.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 18- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Notations This guideline uses the following typographical conventions in text: • Specific terms in CAPITALS represent normative requirements.
17. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 18
Narrow public claim
Each section is labeled as either normative (i.e., mandatory for compliance) or informative (i.e., not mandatory). • Section 1 introduces the document.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 18- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Each section is labeled as either normative (i.e., mandatory for compliance) or informative (i.e., not mandatory). • Section 1 introduces the document.
18. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 19
Narrow public claim
Overview These guidelines use digital identity models that reflect technologies and architectures that are currently available in the market.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 19- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Overview These guidelines use digital identity models that reflect technologies and architectures that are currently available in the market.
19. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 19
Narrow public claim
Service provider: Service providers can perform any combination of functions involved in granting access to and delivering online services, such as a credential service provider, relying party, verifier, and identity provider.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 19- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Service provider: Service providers can perform any combination of functions involved in granting access to and delivering online services, such as a credential service provider, relying party, verifier, and identity provider.
20. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 20
Narrow public claim
While presented as separate roles, the functions of the CSP, verifier, and IdP may be performed by a single entity or distributed across multiple entities, depending on the implementation (see Sec.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 20- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t02_primary_claims.json --source-file <local-raw-pdf>Exact source quote
While presented as separate roles, the functions of the CSP, verifier, and IdP may be performed by a single entity or distributed across multiple entities, depending on the implementation (see Sec.
21. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 20
Narrow public claim
Authentication and Authenticator Management [SP800-63B], Authentication and Authenticator Management, provides normative descriptions of permitted authenticator types, their characteristics (e.g., phishing resistance), and authentication processes appropriate for each AAL.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 20- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Authentication and Authenticator Management [SP800-63B], Authentication and Authenticator Management, provides normative descriptions of permitted authenticator types, their characteristics (e.g., phishing resistance), and authentication processes appropriate for each AAL.
22. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 22
Narrow public claim
Biometric characteristics are unique, personal attributes that can be used to verify the identity of a person who is physically present at the point of authentication.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 22- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Biometric characteristics are unique, personal attributes that can be used to verify the identity of a person who is physically present at the point of authentication.
23. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 22
Narrow public claim
While biometric characteristics cannot be used for single-factor authentication, they can be used as an authentication factor for multi-factor authentication in combination with a physical authenticator (i.e., something you have).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 22- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
While biometric characteristics cannot be used for single-factor authentication, they can be used as an authentication factor for multi-factor authentication in combination with a physical authenticator (i.e., something you have).
24. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 23
Narrow public claim
Section III of OMB [M-19-17], Enabling Mission Delivery through Improved Identity, Credential, and Access Management, directs agencies to support cross-government identity federation and interoperability.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 23- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Section III of OMB [M-19-17], Enabling Mission Delivery through Improved Identity, Credential, and Access Management, directs agencies to support cross-government identity federation and interoperability.
25. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 25
Narrow public claim
4, the verifier does not always need to communicate in real time with the CSP to complete the authentication activity (e.g., digital certificates can be used).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 25- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
4, the verifier does not always need to communicate in real time with the CSP to complete the authentication activity (e.g., digital certificates can be used).
26. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 25
Narrow public claim
Non-Federated Digital Identity Model Figure 3 shows an example of a common sequence of interactions in the non-federated model.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 25- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Non-Federated Digital Identity Model Figure 3 shows an example of a common sequence of interactions in the non-federated model.
27. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 26
Narrow public claim
Non-Federated Digital Identity Model Example Steps 3 through 5 can immediately follow steps 1 and 2 or be done at a later time.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 26- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Non-Federated Digital Identity Model Example Steps 3 through 5 can immediately follow steps 1 and 2 or be done at a later time.
28. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 26
Narrow public claim
The RP optionally uses this information to make authorization decisions. • Step 5: An authenticated session is established between the subscriber and the RP.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 26- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The RP optionally uses this information to make authorization decisions. • Step 5: An authenticated session is established between the subscriber and the RP.
29. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 27
Narrow public claim
Federated Digital Identity Model Example Figure 4 shows an example of those same common interactions in a federated model. • Step 1: An applicant applies to a CSP through an identity proofing and enrollment process.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 27- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Federated Digital Identity Model Example Figure 4 shows an example of those same common interactions in a federated model. • Step 1: An applicant applies to a CSP through an identity proofing and enrollment process.
30. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 27
Narrow public claim
The CSP identity-proofs that applicant. • Step 2: Upon successful identity proofing, the applicant is enrolled in the identity service as a subscriber. – A subscriber account and corresponding authenticators are established between the CSP and the subscriber. – The IdP is provisioned either directly by the CSP or indirectly through access to attributes of the subscriber account.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 27- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t03_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The CSP identity-proofs that applicant. • Step 2: Upon successful identity proofing, the applicant is enrolled in the identity service as a subscriber. – A subscriber account and corresponding authenticators are established between the CSP and the subscriber. – The IdP is provisioned either directly by the CSP or indirectly through access to attributes of the subscriber account.
31. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 28
Narrow public claim
The usual sequence of interactions involved in using one or more authenticators in the federated model to perform digital authentication is as follows: • Step 3: The RP requests that the claimant authenticate and requests any attributes needed from the IdP to make access or authorization decisions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 28- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The usual sequence of interactions involved in using one or more authenticators in the federated model to perform digital authentication is as follows: • Step 3: The RP requests that the claimant authenticate and requests any attributes needed from the IdP to make access or authorization decisions.
32. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 28
Narrow public claim
RPs use a subscriber’s federated identity (pseudonymous or non-pseudonymous), IAL, AAL, FAL, and other factors to make authorization decisions. • Step 6: An authenticated session is established between the subscriber and the RP.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 28- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
RPs use a subscriber’s federated identity (pseudonymous or non-pseudonymous), IAL, AAL, FAL, and other factors to make authorization decisions. • Step 6: An authenticated session is established between the subscriber and the RP.
33. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 30
Narrow public claim
The usual sequence of interactions involved in providing an assertion to the RP from a subscriber-controlled wallet is as follows: • Step 4: The RP requests that the claimant authenticate.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 30- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The usual sequence of interactions involved in providing an assertion to the RP from a subscriber-controlled wallet is as follows: • Step 4: The RP requests that the claimant authenticate.
34. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 30
Narrow public claim
RPs use a subscriber’s federated identity (pseudonymous or non-pseudonymous), IAL, AAL, FAL, and other factors to make authorization decisions. • Step 7: An authenticated session is established between the subscriber and the RP.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 30- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
RPs use a subscriber’s federated identity (pseudonymous or non-pseudonymous), IAL, AAL, FAL, and other factors to make authorization decisions. • Step 7: An authenticated session is established between the subscriber and the RP.
35. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 31
Narrow public claim
The Digital Identity Risk Management (DIRM) process focuses on the identification and management of risks according to two dimensions: (1) risks that result from operating the online service that might be addressed by an identity system and (2) additional risks that are introduced as a result of implementing the identity system.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 31- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
The Digital Identity Risk Management (DIRM) process focuses on the identification and management of risks according to two dimensions: (1) risks that result from operating the online service that might be addressed by an identity system and (2) additional risks that are introduced as a result of implementing the identity system.
36. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 33
Narrow public claim
Using the assurance levels, the organization identifies the baseline controls for the IAL, AAL, and FAL for each user group based on the requirements in companion volumes [SP800-63A], [SP800-63B], and [SP800-63C], respectively.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 33- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Using the assurance levels, the organization identifies the baseline controls for the IAL, AAL, and FAL for each user group based on the requirements in companion volumes [SP800-63A], [SP800-63B], and [SP800-63C], respectively.
37. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 36
Narrow public claim
For example, an online income tax filing and review service may have the following user groups: (1) citizens who need to check the status of their personal tax returns, (2) tax preparers who file tax returns on behalf of their clients, and (3) system administrators who assign privileges to different groups of users or create new user groups as needed.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 36- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, an online income tax filing and review service may have the following user groups: (1) citizens who need to check the status of their personal tax returns, (2) tax preparers who file tax returns on behalf of their clients, and (3) system administrators who assign privileges to different groups of users or create new user groups as needed.
38. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 37
Narrow public claim
Additionally, organizations SHALL identify other entities (e.g., mission partners, communities, and those identified in [SP800-30]) that need to be specifically included based on mission and business needs.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 37- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Additionally, organizations SHALL identify other entities (e.g., mission partners, communities, and those identified in [SP800-30]) that need to be specifically included based on mission and business needs.
39. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 42
Narrow public claim
3.2.2) The impact analysis SHALL consider the level of impact for each impact category for each type of impacted entity if an intruder obtains unauthorized access as a member of each user group.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 42- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
3.2.2) The impact analysis SHALL consider the level of impact for each impact category for each type of impacted entity if an intruder obtains unauthorized access as a member of each user group.
40. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 43
Narrow public claim
3.3.1) to identify the corresponding set of baseline digital identity controls from the requirements and guidelines in the companion volumes [SP800-63A], [SP800-63B], and [SP800-63C].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 43- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t04_primary_claims.json --source-file <local-raw-pdf>Exact source quote
3.3.1) to identify the corresponding set of baseline digital identity controls from the requirements and guidelines in the companion volumes [SP800-63A], [SP800-63B], and [SP800-63C].
41. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 43
Narrow public claim
While high-level descriptions of the assurance levels are provided in this subsection, readers of this guideline are encouraged to refer to companion volumes [SP800-63A], [SP800-63B], and [SP800-63C] for normative guidelines and requirements for each assurance level.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 43- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
While high-level descriptions of the assurance levels are provided in this subsection, readers of this guideline are encouraged to refer to companion volumes [SP800-63A], [SP800-63B], and [SP800-63C] for normative guidelines and requirements for each assurance level.
42. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 44
Narrow public claim
Identity Assurance Level • IAL1: IAL1 supports the real-world existence of the claimed identity and provides some assurance that the applicant is associated with that identity.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 44- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Identity Assurance Level • IAL1: IAL1 supports the real-world existence of the claimed identity and provides some assurance that the applicant is associated with that identity.
43. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 45
Narrow public claim
Authentication Assurance Level • AAL1: AAL1 provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 45- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Authentication Assurance Level • AAL1: AAL1 provides basic confidence that the claimant controls an authenticator that is bound to the subscriber account.
44. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 46
Narrow public claim
Successful authentication requires the claimant to prove possession and control of the authenticator through a secure authentication protocol. • AAL2: AAL2 provides high confidence that the claimant controls one or more authenticators that are bound to the subscriber account.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 46- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Successful authentication requires the claimant to prove possession and control of the authenticator through a secure authentication protocol. • AAL2: AAL2 provides high confidence that the claimant controls one or more authenticators that are bound to the subscriber account.
45. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 46
Narrow public claim
Approved cryptographic techniques are required. • AAL3: AAL3 provides very high confidence that the claimant controls authenticators that are bound to the subscriber account.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 46- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Approved cryptographic techniques are required. • AAL3: AAL3 provides very high confidence that the claimant controls authenticators that are bound to the subscriber account.
46. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 47
Narrow public claim
FAL Summary FAL Control Objectives User Profile FAL1 Protect against forged No sensitive personal assertions. information is available to any users but some profile or preference data may be retained to support usability or the customization of applications.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 47- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
FAL Summary FAL Control Objectives User Profile FAL1 Protect against forged No sensitive personal assertions. information is available to any users but some profile or preference data may be retained to support usability or the customization of applications.
47. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 47
Narrow public claim
FAL2 Protect against forged assertions Users can access personal and injection attacks. information and other sensitive data with appropriate authentication assurance levels (e.g., AAL2 or above).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 47- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
FAL2 Protect against forged assertions Users can access personal and injection attacks. information and other sensitive data with appropriate authentication assurance levels (e.g., AAL2 or above).
48. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 48
Narrow public claim
3.2.4) do not differentiate between identity proofing, authentication, and federation risks, the selected initial xALs may still be different.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 48- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
3.2.4) do not differentiate between identity proofing, authentication, and federation risks, the selected initial xALs may still be different.
49. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 48
Narrow public claim
For example, the initial impact assessment may be low impact and indicate IAL1 and FAL1 but may also determine that personal information is accessible and therefore requires AAL2.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 48- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, the initial impact assessment may be low impact and indicate IAL1 and FAL1 but may also determine that personal information is accessible and therefore requires AAL2.
50. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 49
Narrow public claim
For example, [EO13681] states that “all organizations making personal data accessible to citizens through digital applications require the use of multiple factors of authentication,” which requires a minimum selection of AAL2 for applications that meet those criteria.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 49- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t05_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, [EO13681] states that “all organizations making personal data accessible to citizens through digital applications require the use of multiple factors of authentication,” which requires a minimum selection of AAL2 for applications that meet those criteria.
51. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 49
Narrow public claim
Consistent with [M-19-17], federal agencies that operate online services SHOULD implement federation as an option for user access.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 49- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Consistent with [M-19-17], federal agencies that operate online services SHOULD implement federation as an option for user access.
52. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 50
Narrow public claim
For online services that are assessed to be high impact, organizations SHALL conduct a further assessment to evaluate the risk of a compromised IdP to determine whether FAL2 or FAL3 is more appropriate for their use case.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 50- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For online services that are assessed to be high impact, organizations SHALL conduct a further assessment to evaluate the risk of a compromised IdP to determine whether FAL2 or FAL3 is more appropriate for their use case.
53. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 50
Narrow public claim
Identify Baseline Controls The selection of the initial assurance levels for each user group and each of the applicable identity functions (i.e., IAL, AAL, and FAL) serves as the basis for selecting the baseline digital identity controls from the guidelines in companion volumes [SP800-63A], [SP800-63B], and [SP800-63C].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 50- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Identify Baseline Controls The selection of the initial assurance levels for each user group and each of the applicable identity functions (i.e., IAL, AAL, and FAL) serves as the basis for selecting the baseline digital identity controls from the guidelines in companion volumes [SP800-63A], [SP800-63B], and [SP800-63C].
54. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 51
Narrow public claim
As a part of the tailoring process, organizations SHALL review the Digital Identity Acceptance Statements and practice statements2 from CSPs and IdPs that they use or intend to use.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 51- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
As a part of the tailoring process, organizations SHALL review the Digital Identity Acceptance Statements and practice statements2 from CSPs and IdPs that they use or intend to use.
55. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 52
Narrow public claim
3.4.4) • SHALL justify and document all risk-based decisions or modifications to the initially assessed xALs in the Digital Identity Acceptance Statement (see Sec.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 52- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
3.4.4) • SHALL justify and document all risk-based decisions or modifications to the initially assessed xALs in the Digital Identity Acceptance Statement (see Sec.
56. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 52
Narrow public claim
3.3.4 to the final xAL selection and implementation, organizations SHALL conduct detailed assessments of the controls defined for the initially selected xALs to identify potential impacts in the operational environment.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 52- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
3.3.4 to the final xAL selection and implementation, organizations SHALL conduct detailed assessments of the controls defined for the initially selected xALs to identify potential impacts in the operational environment.
57. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 60
Narrow public claim
Redress Designing services that support a wide range of populations requires processes to adjudicate issues and provide redress4 as warranted.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 60- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Redress Designing services that support a wide range of populations requires processes to adjudicate issues and provide redress4 as warranted.
58. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 60
Narrow public claim
Beyond these activities, additional practices can be implemented to ensure that users of identity management systems are able 4Redress generally refers to a remedy that is made after harm occurs.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 60- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Beyond these activities, additional practices can be implemented to ensure that users of identity management systems are able 4Redress generally refers to a remedy that is made after harm occurs.
59. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 62
Narrow public claim
Companion volumes [SP800-63A], [SP800-63B], and [SP800-63C] provide specific fraud mitigation requirements related to each of the identity functions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 62- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Companion volumes [SP800-63A], [SP800-63B], and [SP800-63C] provide specific fraud mitigation requirements related to each of the identity functions.
60. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 64
Narrow public claim
References This section is informative. [EO13681] Obama B (2014) Improving the Security of Consumer Financial Transactions.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 64- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t06_primary_claims.json --source-file <local-raw-pdf>Exact source quote
References This section is informative. [EO13681] Obama B (2014) Improving the Security of Consumer Financial Transactions.
61. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 65
Narrow public claim
(Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 8446. https: //doi.org/10.17487/RFC8446 [RFC9325] Sheffer Y, Saint-Andre P, Fossati T (2022) Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS).
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 65- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
(Internet Engineering Task Force (IETF)), IETF Request for Comments (RFC) 8446. https: //doi.org/10.17487/RFC8446 [RFC9325] Sheffer Y, Saint-Andre P, Fossati T (2022) Recommendations for Secure Use of Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS).
62. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 74
Narrow public claim
For example, for the attribute “birthday,” a value could be “12/1/1980” or “December 1, 1980.” audience restriction The restriction of a message to a specific target audience to prevent a receiver from unknowingly processing a message that is intended for another recipient.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 74- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For example, for the attribute “birthday,” a value could be “12/1/1980” or “December 1, 1980.” audience restriction The restriction of a message to a specific target audience to prevent a receiver from unknowingly processing a message that is intended for another recipient.
63. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 74
Narrow public claim
Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) [RFC9325] are examples of authenticated protected channels in which the certificate presented by the recipient is verified by the initiator.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 74- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) [RFC9325] are examples of authenticated protected channels in which the certificate presented by the recipient is verified by the initiator.
64. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 77
Narrow public claim
This concept has historically been known as a “blacklist.” bound authenticator An authenticator verified by the RP in addition to an assertion at FAL3.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 77- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
This concept has historically been known as a “blacklist.” bound authenticator An authenticator verified by the RP in addition to an assertion at FAL3.
65. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 79
Narrow public claim
For the purposes of these guidelines, key requirements shall meet the minimum requirements stated in Table 2 of [SP800-57Part1].
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 79- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
For the purposes of these guidelines, key requirements shall meet the minimum requirements stated in Table 2 of [SP800-57Part1].
66. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 80
Narrow public claim
In previous editions of SP 800-63, this was referred to as “electronic authentication.” digital identity An attribute or set of attributes that uniquely describes a subject within a given context.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 80- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
In previous editions of SP 800-63, this was referred to as “electronic authentication.” digital identity An attribute or set of attributes that uniquely describes a subject within a given context.
67. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 85
Narrow public claim
Passwords were referred to as memorized secrets in the initial release of SP 800-63B. personal identification number (PIN) A password that typically consists of only decimal digits.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 85- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
Passwords were referred to as memorized secrets in the initial release of SP 800-63B. personal identification number (PIN) A password that typically consists of only decimal digits.
68. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 86
Narrow public claim
It usually describes the parties’ policies and practices and can become legally binding. predictability Enabling reliable assumptions by individuals, owners, and operators about personal information and its processing by an information system. [NISTIR8062] presentation attack Presentation to the biometric data capture subsystem with the goal of interfering with the operation of the biometric system.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 86- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It usually describes the parties’ policies and practices and can become legally binding. predictability Enabling reliable assumptions by individuals, owners, and operators about personal information and its processing by an information system. [NISTIR8062] presentation attack Presentation to the biometric data capture subsystem with the goal of interfering with the operation of the biometric system.
69. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 95
Narrow public claim
SP 800-63-1 updated NIST SP 800-63 to reflect current authenticator (then referred to as “token”) technologies and restructured it to provide a better understanding of the digital identity architectural model used here.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 95- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
SP 800-63-1 updated NIST SP 800-63 to reflect current authenticator (then referred to as “token”) technologies and restructured it to provide a better understanding of the digital identity architectural model used here.
70. NIST SP 800-63-4 Digital Identity Guidelines · PDF page 95
Narrow public claim
It also moved the whole of digital identity guidance covered under SP 800-63 from a single document describing authentication to a suite of four documents (to separately address the individual components mentioned above) of which SP 800-63-3 is the top-level document.
What this card proves
The exact quoted statement occurred in the named official PDF fetched on 2026-08-04, and the complete PDF matched the recorded SHA-256.
What this card does not prove
It does not independently establish the underlying model capability, safety, comparison, or real-world truth. This is a retrospective single-maintainer source-publication audit.
- Primary source
- NIST SP 800-63-4 Digital Identity Guidelines
- Section locator
PDF page 95- Captured
- 2026-08-04
- Source SHA-256
2f5b107de218a0fc3fe7f7e91b2ece5babb001eda5745b7c568a3cc876002f2d- Reproduction
- Maintainer run only; no independent operator rerun is registered.
Repeat this exact check locally
Download the PDF to a local file, then run the committed verifier. A changed PDF is reported as drift rather than silently accepted.
python scripts/verify_primary_public_claim_group.py artifacts/cb7k_dom009_t07_primary_claims.json --source-file <local-raw-pdf>Exact source quote
It also moved the whole of digital identity guidance covered under SP 800-63 from a single document describing authentication to a suite of four documents (to separately address the individual components mentioned above) of which SP 800-63-3 is the top-level document.