# Lead author, NIST SP 800-63-3

Source: https://startwithidentity.com/experts/paul-grassi/
Last updated: 2026-09-21
License: content by Start with Identity. Cite the source URL.

---

## Bio

Paul Grassi led NIST SP 800-63-3 with Michael Garcia and James Fenton in NIST's Applied Cybersecurity Division. The 2017 revision restructured federal digital identity guidance and, in the process, changed what most of the industry considered good practice.

Profile built from public NIST publication records.

## Where their work shows up

Two changes from that document travelled well beyond federal systems. It split a single assurance level into [IAL](https://startwithidentity.com/glossary/ial/), [AAL](https://startwithidentity.com/glossary/aal/), and FAL, so an organization can demand strong authentication without demanding document proofing, or the reverse. And it told federal agencies to stop requiring password composition rules and periodic rotation, citing the usability research, which gave every security team elsewhere the citation they needed to do the same. See [NIST 800-63](https://startwithidentity.com/glossary/nist-800-63/) and [what is passwordless](https://startwithidentity.com/guides/fundamentals/what-is-passwordless/).