# NIST Digital Identity Guidelines (SP 800-63-4): from draft to final

Source: https://startwithidentity.com/blog/2024-08-21-nist-releases-updated-digital-identity-guidelines-sp-800-63-4-draft/
Last updated: 2026-07-27
License: content by Start with Identity. Cite the source URL.

---

NIST published a public draft of SP 800-63-4 in August 2024 and finalised the revision in July 2025. It took roughly four years and about 6,000 public comments, which is a fair measure of how contested the previous edition had become.

Four changes matter most. Syncable authenticators, meaning [passkeys](https://startwithidentity.com/glossary/passkey/) that sync across a vendor's cloud, are explicitly in scope rather than an awkward fit, which removes the main excuse for treating them as unsuitable in regulated environments. The federation model admits subscriber-controlled wallets, aligning it with [verifiable credentials](https://startwithidentity.com/standards/verifiable-credentials/) work. New controls address injection attacks and forged media, deepfakes included, the first time synthetic media appears as a proofing threat. Identity proofing itself is restructured around clearer roles and expanded fraud requirements.

## Why it matters

If you have been told that synced passkeys cannot meet a compliance bar, this is the document that settles the argument. 800-63-4 is what US federal agencies work to and what auditors in regulated industries reach for, so its treatment of an authenticator type effectively decides whether that type is deployable. Revisit any [passwordless strategy](https://startwithidentity.com/guides/authentication/passwordless-strategy/) scoped against 800-63-3 assumptions, and ask your identity proofing vendor what it does about forged media, because the guidelines now expect an answer.

Source: [NIST SP 800-63-4](https://pages.nist.gov/800-63-4/)