The Advanced Technology Academic Research Center has published a 41-page implementation guide for organizations moving from NIST Special Publication 800-63-3 to revision 4 of the Digital Identity Guidelines. The document was produced by ATARC’s Identity Management Working Group and is aimed primarily at federal identity and access-management teams.
The guide organizes the transition around NIST’s five-step Digital Identity Risk Management process. Organizations are directed to define an online service, assess possible harms, select initial assurance levels, tailor controls for privacy, customer experience and threats, and continuously evaluate performance.
That lifecycle replaces a more static approach to selecting identity, authenticator and federation assurance levels. The guide recommends recording the final decisions and compensating controls in a Digital Identity Acceptance Statement, with performance data and user feedback feeding later reassessments.
Its implementation sections cover Identity Assurance Levels, Authenticator Assurance Levels and Federation Assurance Levels. Templates include service inventories, gap analyses and a phased roadmap that moves from policy preparation into phishing-resistant authentication, session and recovery changes, user testing and ongoing monitoring.
The authentication guidance says phishing-resistant options such as FIDO2 passkeys or PIV credentials must be offered at AAL2. It also notes that synced authenticators can be used at AAL2 but not AAL3, where a non-exportable cryptographic key is required. For facial recognition at AAL2 and AAL3, the guide calls for presentation attack detection.
NIST finalized revision 4 of the guidelines in 2025, expanding requirements around fraud, privacy, customer experience, biometrics and redress. Other assurance organizations have since begun aligning evaluation material, including Kantara’s criteria for revision 4 identity assurance.
ATARC also addresses artificial intelligence and machine learning used in proofing, authentication or fraud systems. The guide calls for documentation of training data, testing and model updates, along with privacy assessment and human intervention in redress processes.
The paper is implementation advice from working-group members, not a replacement for NIST’s normative text. ATARC’s disclaimer says the authors participated in personal capacities and the guide does not represent official policy or endorse a vendor. Implementers are directed back to the relevant sections of the NIST publications when evaluating specific compliance requirements and technical controls.
–
By Ji-seo Kim
