# NIST opens an implementation hub for SP 800-63-4, with machine-readable conformance criteria

Source: https://startwithidentity.com/blog/2026-10-06-nist-opens-implementation-hub-for-sp-800-63-4/
Last updated: 2026-10-06
License: content by Start with Identity. Cite the source URL.

---

NIST's Digital Identity Group launched an online hub on October 6 for organizations implementing [SP 800-63-4](https://startwithidentity.com/glossary/nist-800-63/), the Digital Identity Guidelines finalized in July 2025. The [Implementation Resources site](https://pages.nist.gov/800-63-4-Implementation-Resources/) adds no new requirements; the normative text stays in the four volumes. It offers FAQs on core attributes, authoritative and credible sources, trusted referees, password requirements and password managers. Version 0.1 conformance criteria organize the requirements of all four volumes into structured controls, published in Excel, PDF and OSCAL (JSON, XML and YAML) for assessment tooling. There is also an explainer on the subscriber-controlled wallet model for verifiable credentials and mobile driver's licenses, and an authenticator reference comparing methods on replay and phishing resistance. NIST says it does not certify against the criteria. A Digital Identity Risk Management tool is listed as coming soon.

## Why it matters

The OSCAL criteria are the practical piece. Teams mapping an identity stack to [IAL](https://startwithidentity.com/glossary/ial/) and [AAL](https://startwithidentity.com/glossary/aal/) have been doing it by hand from prose; a structured control set can be loaded into a GRC tool and tracked per requirement. Use it as a gap checklist against your proofing, authenticator and federation settings, keeping in mind it is version 0.1 and not a certification.

The authenticator reference is worth sending to anyone still treating SMS as equivalent to [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/). And the wallet explainer signals that agencies should plan for [mobile driver's licenses](https://startwithidentity.com/glossary/mobile-drivers-license/) as a proofing input rather than a pilot.

Source: [Biometric Update](https://www.biometricupdate.com/202610/nist-launches-resource-hub-to-support-sp-800-63-4-implementation)