NIST's revised SP 800-63A defines six expected outcomes of identity proofing

Identity resolution comes with a scope qualifier, and the qualifier decides how much engineering it costs. The document defines that outcome as determining that the claimed identity corresponds to a single, unique individual within the context of the population of users served by the credential service provider or online service ^[7]. That uniqueness only has to hold within that population: deduplication has to work inside your own subscriber set, and the outcome asks nothing about whether the same person is already enrolled somewhere else.

Three of the outcomes are separate checks that one submitted document can pass unevenly. Evidence validation confirms that the supplied identity evidence is genuine, authentic, and accurate ^[8]. Attribute validation confirms the accuracy of the core attributes ^[9]. Identity verification confirms that the applicant is the genuine owner of the presented evidence and attributes ^[10]. A pipeline that authenticates a passport image and matches the name and date of birth against a source of record has produced the first two; binding the person in the session to that passport is a third requirement with its own name.

Core attributes are defined as the minimum set of attributes required to complete identity proofing and provide services ^[9], and the guidance pairs the outcomes with privacy-enhancing principles such as data minimization plus usability practices that reduce the burden on applicants ^[14].

The examples the document gives of activity that needs a reliable link to a real person include executing financial transactions, meeting the financial industry's Customer Identification Program requirements, and changing the release rate of water from a dam ^[19].

The level enumeration begins with a tier called no identity proofing, where there is no requirement to link the applicant to a specific real-life person, evidence collection is not required, and identity verification is not conducted ^[16]. Attributes may still be validated as part of other business processes at that tier, and validation is simply not required for access ^[17]. At IAL1, core attributes are obtained from identity evidence or self-asserted by the applicant ^[18], and all core attributes are validated against authoritative sources; the retrieved text breaks off mid-word at that point ^[23].

The published text does not carry a change list. Its version history is a single sentence in the abstract saying the publication supersedes NIST SP 800-63A, with no statement of which requirements moved ^[2][22]. Each successive IAL builds on the requirements of the levels below it ^[15], so a requirement that changed at IAL1 changed at IAL2 and IAL3 as well. The page carries a date of 26 August 2025 and no compliance deadline ^[20][22].