NIST SP 800-63B: Digital Identity Guidelines (Authentication and Lifecycle Management)
Federal authentication framework defining three Authenticator Assurance Levels (AAL1, AAL2, AAL3), authenticator types, and lifecycle requirements.
Primary source
NIST SP 800-63B →https://pages.nist.gov/800-63-3/sp800-63b.html
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
NIST SP 800-63B — part of the SP 800-63 Digital Identity Guidelines suite — is the federal reference for authentication and authenticator lifecycle management.
Three Authenticator Assurance Levels (AALs):
- AAL1: single- or multi-factor authentication; replay-resistant; modest assurance.
- AAL2: multi-factor authentication using two factors; replay-resistant; approved cryptography; the practical baseline for protecting personal data online.
- AAL3: multi-factor authentication using one or more hardware-based cryptographic authenticators; verifier impersonation resistant; verifier-CSP communication authenticated.
Authenticator types: memorized secrets (passwords), look-up secrets, out-of-band devices, single-factor OTP devices (TOTP), multi-factor OTP devices, single-factor cryptographic devices, multi-factor cryptographic devices, multi-factor cryptographic software (PIV-card-equivalents), single-factor cryptographic software.
Key practical positions:
- SMS for OTP is "restricted" — discouraged because of SS7 and SIM-swap risk, though still permitted at AAL2 with appropriate awareness.
- Memorized secrets must be at least 8 characters when chosen by subscriber; complexity rules deprecated in favor of length and dictionary checking.
- Phishing-resistant authenticators (FIDO2/WebAuthn, PIV) recommended for high-value accounts.
A draft Revision 4 of the broader SP 800-63 suite has been in public comment and may further raise the bar; 63B-r4 is referenced in OMB M-22-09 guidance for federal agencies and is influential beyond government.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationNIST SP 800-66 Revision 2: HIPAA Security Rule Cybersecurity Resource GuideNIST's 2024 update to the implementation guide for the HIPAA Security Rule, mapping the rule's standards to NIST Cybersecurity Framework subcategories and current cybersecurity practices.
- RegulationHIPAA Person or Entity Authentication (45 CFR 164.312(d))Required standard to verify that a person or entity seeking access to ePHI is the one claimed. The Security Rule is technology-neutral on the mechanism; risk analysis drives whether MFA is reasonable.
- RegulationHIPAA Security Rule: General Rules (45 CFR 164.306)Required objectives — confidentiality, integrity, and availability of ePHI — plus the flexibility provisions that govern how covered entities select and implement specific safeguards.
- GlossaryMFA (Multi-Factor Authentication)Authentication requiring two or more independent factors — something you know, have, or are.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- RegulationNIST SP 800-53 Revision 5: Security and Privacy Controls for Information Systems and OrganizationsThe authoritative federal control catalog organizing technical, operational, and management security and privacy controls into 20 control families.
- RegulationNIST SP 800-88 Revision 1: Guidelines for Media SanitizationFederal reference for sanitizing electronic media — Clear, Purge, and Destroy categories — with method selection based on media type and confidentiality of the data.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.