Category: Identity & Access Management

Federation Assurance Level

Also known as: FAL, Federation Assurance Levels

Simply put

Federation Assurance Level (FAL) is a way of grading how securely one system shares proof of a user's identity with another system in a federated setup, where an identity provider vouches for a user to a separate service. It is one of the assurance measures defined in the NIST SP 800-63 digital identity guidelines. Higher levels are intended to provide stronger protections for the messages, called assertions, that carry authentication and attribute information between systems.

Formal definition

As defined in NIST SP 800-63 (Digital Identity Guidelines, SP 800-63C addressing federation), FAL is a category that describes the federation protocol used to communicate an assertion containing authentication and attribute information from an identity provider to a relying party, and specifies the requirements for securing the federation transaction at each level. The guidelines articulate multiple levels of increasing rigor, with FAL 3 representing a very high assurance tier; practitioners should consult the applicable revision of SP 800-63C for the specific requirements, level definitions, and any tailoring, as these evolve across revisions. FAL is distinct from other SP 800-63 assurance components such as identity assurance and authentication assurance, and this entry does not cover the detailed protocol, cryptographic, or implementation requirements, which the reader should verify against the current authoritative NIST text.

Why it matters

Federated identity architectures let organizations rely on an external identity provider to authenticate users rather than managing separate credentials for every service. This convenience introduces a distinct risk surface: the assertions that carry authentication and attribute information between the identity provider and the relying party can be intercepted, replayed, forged, or misdirected if the federation transaction is not adequately protected. Federation Assurance Level (FAL) exists to give organizations a structured way to reason about how much protection the federation channel and its assertions actually provide, rather than treating all single sign-on arrangements as equivalent.

For compliance officers and system security personnel, FAL matters because it is one of the assurance components defined in the NIST SP 800-63 digital identity guidelines, alongside identity assurance and authentication assurance. Selecting an appropriate FAL is generally part of aligning a federated system with the risk tolerance for a given application, particularly where authentication events cross organizational or system boundaries. Choosing too low a level for a sensitive relying party can leave assertion handling under-protected, while the higher tiers, up to FAL 3 described as a very high assurance level, impose more rigorous requirements on how the transaction is secured.

A common expert correction is that FAL should not be conflated with the other assurance components in SP 800-63. A high level of identity proofing or a strong authenticator does not by itself guarantee that the federated communication of that authentication is protected to a comparable degree. FAL specifically addresses the strength and security of the federation transaction, so it must be evaluated on its own terms. Because the level definitions and their detailed requirements evolve across revisions of SP 800-63C, readers should confirm the specific tiering and controls against the current authoritative NIST text rather than assuming a fixed set of requirements.

Who it's relevant to

Information System Security Managers and Security Architects

Personnel responsible for designing or operating federated authentication should use FAL to specify how the federation transaction must be secured, and to ensure that the protection of assertions is evaluated separately from identity proofing and authenticator strength. They should verify the requirements of the targeted level against the applicable revision of NIST SP 800-63C.

Compliance Officers and Auditors

Those assessing digital identity implementations against the NIST SP 800-63 guidelines can use FAL as one of the distinct assurance components to check, alongside identity assurance and authentication assurance. Auditors should confirm that the claimed FAL corresponds to the actual federation configuration and to the level definitions in the current authoritative NIST text, since these evolve across revisions.

Authorizing Officials and Risk Owners

Officials making risk-based decisions about systems that rely on external identity providers should understand that selecting an appropriate FAL is part of aligning federated authentication with the system's risk tolerance. They should not treat a strong authentication or identity assurance posture as evidence that the federation channel itself is adequately protected.

Government Contractors and Service Providers

Organizations building or supplying federated identity services to public sector customers may need to demonstrate that their offerings can meet a specified FAL. Because the detailed protocol and implementation requirements are out of scope here and vary by revision, providers should confirm the exact obligations against the current SP 800-63C text and any agency-specific interpretation.

Inside FAL

Assertion Protection Requirements

FAL categorizes the strength of the assertion presented in a federated transaction, addressing how the assertion is protected against threats such as manipulation, forgery, or replay as it moves from the identity provider to the relying party.

Signing and Encryption Expectations

Higher FALs generally require that assertions be cryptographically signed and, at the upper level, encrypted so that only the intended relying party can decrypt them, as described in the applicable revision of NIST SP 800-63C. Verify the current text for the specific requirements at each level.

Holder-of-Key vs. Bearer Assertions

FAL distinguishes between bearer assertions, which can be presented by any party holding them, and holder-of-key assertions, which require the presenter to prove possession of a key referenced in the assertion. The requirement for holder-of-key presentation generally applies at the highest FAL.

Relationship to IAL and AAL

FAL is one of three separately selectable components of digital identity assurance under the NIST SP 800-63 suite, alongside Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL). Each is chosen independently based on risk, and FAL applies specifically to federated architectures rather than direct authentication.

Governing Publication

FAL is defined and maintained by NIST within the SP 800-63 Digital Identity Guidelines, specifically the SP 800-63C volume addressing federation and assertions. Specific level definitions and requirements should be confirmed against the current applicable revision, as this guidance evolves across revisions.

Common questions

Answers to the questions practitioners most commonly ask about FAL.

Is a higher Federation Assurance Level always required for more sensitive systems?

Not necessarily. FAL is one of three independent components in the NIST SP 800-63 (Digital Identity Guidelines) model, alongside Identity Assurance Level (IAL) and Authenticator Assurance Level (AAL). A common mistake is assuming these levels must rise together or that selecting the highest FAL is inherently more compliant. FAL specifically addresses the assertion protocol used in a federated transaction, not identity proofing or authenticator strength. The appropriate FAL is determined through a risk assessment for the federation relationship, and organizations should consult the applicable revision of NIST SP 800-63C and their agency tailoring rather than defaulting to the highest level.

Does FAL only apply when a system uses a federated single sign-on product?

FAL applies to the assertion mechanics of any federated transaction where a relying party accepts an identity assertion from an identity provider, which is broader than assuming it is tied to a specific commercial single sign-on product. The level characterizes properties such as whether assertions are signed, encrypted, and audience-restricted, and whether holder-of-key mechanisms are used, as described in the applicable revision of NIST SP 800-63C. Because terminology and the specific FAL definitions have evolved across revisions of the SP 800-63 suite, readers should confirm the requirements against the current authoritative text and any agency-specific guidance.

How do we determine the appropriate FAL for a given federation relationship?

Selection generally follows a risk assessment of the federated transaction, considering the sensitivity of the information exchanged and the potential impact of an assertion being forged, replayed, or redirected. NIST SP 800-63 guidance associates each level with specific assertion protection properties. Federal agencies may also apply their own tailoring, and DoD systems under the RMF may layer additional requirements. This entry describes the concept and does not substitute for the current SP 800-63C text or agency-specific interpretation, which the reader should verify.

What assertion protections are typically associated with the different FAL tiers?

In most implementations described by NIST SP 800-63C, lower FAL tiers generally require signed, audience-restricted bearer assertions, while higher tiers generally add protections such as encryption of the assertion to the relying party and, at the highest tier, a holder-of-key mechanism in which the subscriber proves possession of a key referenced in the assertion. The precise requirements and any changes across revisions should be confirmed against the applicable authoritative publication rather than assumed from this summary.

How does FAL relate to IAL and AAL when documenting a system authorization package?

FAL, IAL, and AAL are documented as distinct assurance determinations because they address different aspects of digital identity: identity proofing (IAL), authentication strength (AAL), and federation assertion protection (FAL). For a federated system, all three may be relevant, but they are selected and justified independently based on risk. When these determinations feed an authorization package, they support but do not by themselves constitute an ATO decision, which remains time-bound and subject to continuous monitoring. Confirm how your authorizing official expects these levels to be represented.

Does meeting a specified FAL mean the federation is secure or compliant overall?

No. FAL addresses only the assurance properties of the identity assertion within a federated transaction. Meeting a target FAL does not by itself establish that the overall federation, the relying party, or the identity provider is secure or compliant with the full applicable control set, such as NIST SP 800-53 baselines or DoD RMF requirements. Compliance with an assurance level is not equivalent to security, and organizations should treat FAL as one element of a broader control and authorization posture, verified against current authoritative sources.

Common misconceptions

FAL is the same as, or determines, the identity proofing rigor and authenticator strength of a transaction.

FAL, IAL, and AAL are distinct and independently selectable under the NIST SP 800-63 model. FAL addresses the assurance of the federation assertion itself, not how strongly the identity was proofed (IAL) or how strongly the subscriber authenticated (AAL). Conflating them is a common error.

A higher FAL automatically produces a more secure system overall.

FAL addresses only the protection of assertions in a federated exchange. Compliance with a given FAL is not equivalent to comprehensive security, and it must be selected based on a risk assessment alongside other controls. Compliance and security are not interchangeable.

Meeting a FAL under NIST SP 800-63C satisfies all federal or DoD authorization requirements.

FAL is federation-specific guidance from NIST and is generally one input among many. It does not by itself confer an Authority to Operate, satisfy RMF or FISMA obligations, or meet DoD-specific requirements. Applicability and any agency tailoring must be confirmed against the governing authorities for the system in question.

Best practices

Select FAL through a documented risk assessment, choosing it independently from IAL and AAL rather than assuming a single blanket assurance level covers the entire identity transaction.

Confirm the specific signing, encryption, and holder-of-key requirements for the intended FAL against the current applicable revision of NIST SP 800-63C, since these requirements can change across revisions.

Verify that assertions are protected in transit and at rest in a manner consistent with the selected FAL, including cryptographic signing and, where the level requires, encryption scoped to the intended relying party.

Do not treat a chosen FAL as satisfying broader authorization obligations; map it into the applicable RMF, FISMA, or DoD processes and confirm any agency-specific tailoring with the responsible authorizing official.

Document how bearer versus holder-of-key assertion decisions align with the assessed risk, and record the rationale for the relying party's acceptance criteria.

Reassess the selected FAL as part of continuous monitoring, recognizing that federation configurations, guidance revisions, and threat conditions can change over time.