NIST has established Identity Assurance Levels as a method of quantifying how certain an online identity is of being that of an actual individual, ranging from self-asserted (IAL1) to in-person verification (IAL3).

IAL3 is the highest standard, requiring that an independent third party verify in person that an applicant matches up with his/her ID documents and prevents insider threats or sophisticated fraud where traditional security fails. This helps avoid insider risks as well as sophisticated fraud, providing extra layers of protection.

NIST IAL3 verification

IAL3 authentication is designed for high-risk transactions where identity errors could cause irreparable harm. It requires submission of superior-strength identity evidence for verification that it does not include false, compromised, or stolen evidence; as well as a strong authentication process with multiple criteria to ascertain that the person accessing the service exists and can access it.

NIST 800-63A IAL3 was recently updated in 2025 to emphasize modern identity proofing and phishing-resistant authentication, shifting from checklist-based requirements to risk-based framework. The updated guidance supports a flexible identity assurance approach which takes into account threats, service impacts and user populations when making its recommendations.

NIST IAL3 verification using various ID&V combinations that are typically referred to in SP 800-63B shorthand as 1 SUPERIOR plus 2 STRONG or 1 STRONG plus 3 FAIR. In order to confirm a user, an integrator must capture and compare biometric images using IDEMIA Capture SDK to generate strong evidence against that user.

IAL3 identity proofing

IAL3 identity proofing represents the highest level of authentication available and provides maximum confidence that a claimed identity is genuine. This level includes advanced security measures and checks such as document verification, live image comparison and biometric validation - perfect for high-risk use cases such as controlled access to sensitive data or healthcare services regulated by regulations.

NIST's Identity Assurance Levels (IALs) describe how confidently we can be that an individual is who they say they are. These levels are defined in NIST Special Publication NIST 800-63A IAL3 and encompass three different forms of identity proofing:

At IAL3 level, identity validation requires using evidence validation, attribute validation and verification processes to establish an individual's claimed identity. This level also permits applicant references to provide testimony of attributes, conditions and identity when other forms of evidence cannot. CSPs should adopt this best practice when they cannot independently verify an applicant's claim.

IAL3 compliant solution

IAL3 establishes more stringent requirements on verification. To meet them, on-site attended identity proofing sessions and stringent evidence validation are necessary, in addition to remote proofing services being unable to meet them. Such measures ensure a higher level of trust when using high-stake applications such as government services and financial transactions while protecting against more sophisticated attacks like AI deepfakes and voice cloning attacks.

IAL3 compliant solution go beyond facial comparison, requiring live images for face comparison. Furthermore, they include advanced liveness detection to validate an enrollee's presence as well as verifying authentic documents which helps prevent SIM swaps and MFA bypasses.

In accordance with IAL3 solutions, CSP representatives should interact directly with applicants and allow them to inspect documents and examine their face. A recording app such as Trust Swiftly may be used on a lockdown device to record sessions and prevent injection and other biometric attacks from being perpetrated on these sessions. Furthermore, the recorded file should then be made available through an assertion or API for use by registered providers (RPs).

TrustSwiftly

Realizing FedRAMP High authorization is an ambitious goal of many technology companies, but one of its more difficult requirements is developing an efficient IAL3 verification process. Failure to implement such an efficient process may allow unauthorized access to critical systems and data.

The IAL3 verification process must ensure that claimed identities correspond with real world identities by verifying physical presence of claimants. This may involve both remote and in-person processes; what's essential is that they be reliable and verifiable, whether through document verification methods (multispectral UV light analysis, ID ownership verification and selfie liveness detection) or advanced biometrics such as facial recognition with liveness detection, voice recognition or fingerprint scanning.

TrustSwiftly offers an IAL3 compliant solution that combines remote and in-person verification measures with a hardware-backed authenticator to provide the highest level of security while offering seamless user experiences. Furthermore, it features pay-as-you-go pricing plans without long-term contracts for added flexibility.