NIST opens an implementation hub for SP 800-63-4, with machine-readable conformance criteria
NIST launched a resource site for the Digital Identity Guidelines, Revision 4, with FAQs, version 0.1 conformance criteria in Excel, PDF and OSCAL, a subscriber-controlled wallet explainer, and an authenticator reference. It adds no new requirements.
NIST's Digital Identity Group launched an online hub on October 6 for organizations implementing SP 800-63-4, the Digital Identity Guidelines finalized in July 2025. The Implementation Resources site adds no new requirements; the normative text stays in the four volumes. It offers FAQs on core attributes, authoritative and credible sources, trusted referees, password requirements and password managers. Version 0.1 conformance criteria organize the requirements of all four volumes into structured controls, published in Excel, PDF and OSCAL (JSON, XML and YAML) for assessment tooling. There is also an explainer on the subscriber-controlled wallet model for verifiable credentials and mobile driver's licenses, and an authenticator reference comparing methods on replay and phishing resistance. NIST says it does not certify against the criteria. A Digital Identity Risk Management tool is listed as coming soon.
Why it matters
The OSCAL criteria are the practical piece. Teams mapping an identity stack to IAL and AAL have been doing it by hand from prose; a structured control set can be loaded into a GRC tool and tracked per requirement. Use it as a gap checklist against your proofing, authenticator and federation settings, keeping in mind it is version 0.1 and not a certification.
The authenticator reference is worth sending to anyone still treating SMS as equivalent to phishing-resistant MFA. And the wallet explainer signals that agencies should plan for mobile driver's licenses as a proofing input rather than a pilot.
Source: Biometric Update
Related on Start with Identity
- BlogNIST Digital Identity Guidelines (SP 800-63-4): from draft to final
NIST's rewrite of the Digital Identity Guidelines reached final publication in July 2025 after roughly four years and about 6,000 public comments. It brings syn
- BlogA loose PHP comparison let attackers sign in as WordPress admin through SAML
Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signat
- BlogAmerica.gov launches as an AI front door to federal services, with Login.gov as its sign-in
GSA and the White House National Design Studio launched America.gov, an AI-assisted entry point to federal services. The executive order behind it makes Login.g
- PodcastA Digital Identity Digest
Short weekly episodes from standards veteran Heather Flanagan that "translate geek to human" on identity standards, wallets, and the web platform.
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- PodcastIdentity at the Center
The longest-running weekly show on identity and access management programs, hosted by two practitioners. The best single feed for keeping up with the field.