Skip to main content
Comply Defense
Category: Identity & Access Management

Identity Proofing

Also known as: Identity Verification
Simply put

Identity proofing is the process of confirming that a person is who they claim to be before they are granted a credential or access to a service. It generally involves collecting and checking personal information, documents, or biometric data to establish confidence in the individual's identity. It is a distinct step that occurs before ongoing authentication, which verifies an already-established identity at each subsequent access.

Formal definition

Identity proofing is the process of providing and validating sufficient information, such as identity history, credentials, and supporting documents, to establish an individual's identity to a required level of confidence. In NIST guidance (as reflected in the SP 800-63 series, notably the digital identity guidance under SP 800-63A), the process generally involves the presentation and validation of the minimum attributes necessary to accomplish proofing, and it precedes credential issuance and subsequent authentication. Practitioners should not conflate identity proofing (establishing an identity) with authentication (verifying a previously established identity at access time). Specific attribute requirements, validation methods, and assurance levels vary by the applicable revision of the governing NIST publication and by agency tailoring; readers should verify the current authoritative text before implementation.

Why it matters

Identity proofing establishes the foundation on which all subsequent access decisions rest. If an organization issues a credential to the wrong person, or to a fraudulent applicant, every later authentication event faithfully verifies an identity that was never legitimate to begin with. In defense and public sector environments, where credentials can lead to access to Controlled Unclassified Information (CUI) or sensitive systems, weak proofing at enrollment can undermine otherwise strong authentication controls downstream. This is why NIST guidance treats proofing as a distinct step that precedes credential issuance and authentication rather than folding it into the login process.

A common and consequential mistake is conflating identity proofing with authentication. Authentication verifies a previously established identity at the moment of access; proofing establishes that identity in the first place. Treating the two as interchangeable can lead organizations to over-invest in authentication mechanisms while accepting insufficient assurance about who actually received the credential. Because the attribute requirements, validation methods, and assurance levels differ across revisions of the governing NIST publications and can be tailored by individual agencies, compliance officers and ISSMs should confirm which requirements apply to their systems rather than assuming a single universal standard.

Proofing also carries scope-sensitive obligations. The confidence level appropriate for a low-impact citizen-facing service may fall well short of what is expected for access to sensitive government systems, and requirements can vary between federal civilian, defense, and other environments. Readers should verify the current authoritative text and any applicable agency tailoring before relying on a particular proofing approach to satisfy a compliance requirement.

Who it's relevant to

Information System Security Managers and IAM practitioners
Those responsible for identity and access management need to design or evaluate proofing processes that establish identity to the required level of confidence before credentials are issued. They should ensure proofing is treated as a distinct step from authentication and that the validation methods and assurance levels align with the applicable NIST guidance and any agency tailoring.
Compliance officers and auditors
Compliance and assessment personnel must confirm that proofing controls meet the assurance level required for the system's scope and sensitivity, recognizing that requirements differ across environments and change across revisions of the governing NIST publications. They should verify claims against the current authoritative text rather than assuming a single fixed standard.
System owners and service designers for public-facing services
Teams building citizen-facing or user-facing services need to select proofing methods appropriate to the risk and impact of the service, for example, validating an identity through a registered mobile device number or supporting documents. They should confirm that the chosen approach delivers sufficient confidence for the intended use and complies with applicable requirements.

Inside Identity Proofing

Resolution
The process of collecting and validating identity evidence and attributes so that the claimed identity can be uniquely distinguished within a given population or context. This is generally the first analytical step in establishing who an applicant claims to be, as described in NIST SP 800-63A (verify the applicable revision, as this guidance is periodically updated).
Validation
The determination that presented identity evidence is authentic, accurate, and current. Validation typically checks the evidence itself (for example, that a credential is genuine and has not been altered or revoked) against authoritative or issuing sources where available.
Verification
The step confirming that the validated evidence is bound to the person presenting it, generally by linking the applicant to the claimed identity through methods such as biometric comparison or a comparable binding technique. Verification is distinct from validation and should not be treated as the same activity.
Identity Assurance Level (IAL)
A categorization, defined in the NIST SP 800-63 series and maintained by NIST, that expresses the rigor of the identity proofing process. Different IALs generally correspond to different evidence, validation, and verification requirements. IAL is separate from Authenticator Assurance Level (AAL) and Federation Assurance Level (FAL), and conflating them is a common error.
Identity Evidence
The documents or records (such as government-issued credentials or authoritative records) an applicant provides to support a claimed identity. The strength, number, and type of acceptable evidence generally vary by the required assurance level and by agency tailoring.
Remote vs. In-Person Proofing
Identity proofing may be conducted in person, remotely (including supervised remote sessions), or through hybrid approaches. The permitted method depends on the applicable assurance level and any agency-specific requirements; not all methods are acceptable at every level.

Common questions

Answers to the questions practitioners most commonly ask about Identity Proofing.

Is identity proofing the same thing as authentication?
No. Identity proofing and authentication are distinct processes that are often conflated. Identity proofing generally establishes that a claimed identity corresponds to a real person before an account or credential is issued, whereas authentication verifies that a returning subject is the same entity to whom the credential was issued. Under the NIST SP 800-63 family of guidelines, identity proofing is addressed by the Identity Assurance Level (IAL) construct, while authentication strength is addressed separately by the Authenticator Assurance Level (AAL). Treating a strong authentication mechanism as a substitute for adequate proofing is a common mistake; a robust authenticator confirms possession or control but does not, by itself, establish that the underlying identity was ever validated. Readers should confirm the specific requirements against the applicable revision of SP 800-63.
Does completing identity proofing mean an identity is permanently verified?
Not necessarily. Identity proofing establishes assurance at the time it is performed, but that assurance is generally not treated as permanent. Depending on the applicable policy and the assurance level involved, organizations may need to account for identity data that becomes stale, evidence that expires, or life events that change the validity of previously collected information. Some implementations incorporate periodic re-proofing, re-validation of evidence, or event-driven review. The specific expectations for maintaining identity assurance over time depend on agency policy and the applicable revision of the governing guidance, which the reader should verify against current official sources.
How is the required level of identity proofing determined for a system?
The required level of identity proofing is generally determined by assessing the risk associated with an erroneous identity assertion, which under the NIST SP 800-63 approach maps to an Identity Assurance Level (IAL). Higher IALs typically call for more rigorous collection and validation of identity evidence. Organizations commonly consider the sensitivity of the information or transactions involved, potential harm from impersonation, and applicable agency or program requirements. Because impact determinations and assurance selection are subject to agency tailoring and revision, the reader should confirm the applicable methodology against current authoritative guidance and any program-specific direction.
What types of identity evidence are typically accepted during proofing?
Identity proofing processes generally rely on collecting and validating identity evidence, which may include documents or records whose authenticity and accuracy can be checked against authoritative or issuing sources. In most implementations, higher assurance levels call for stronger evidence and more rigorous validation and verification steps. The specific categories, quantity, and strength of acceptable evidence depend on the targeted assurance level and the applicable revision of the governing guidance. This entry does not enumerate specific acceptable documents; the reader should consult the current authoritative text and any agency-specific policy for exact requirements.
Can identity proofing be performed remotely, or must it be done in person?
Both remote and in-person identity proofing are generally recognized approaches, and guidance in the NIST SP 800-63 family has addressed proofing conducted through different channels. Remote proofing typically introduces additional considerations for validating evidence and confirming that the applicant is the rightful holder, while in-person or supervised approaches may reduce certain risks. The availability and acceptability of a given proofing channel depend on the targeted assurance level, agency policy, and the applicable revision of the guidance. The reader should verify permissible methods and any associated controls against current official sources before selecting an approach.
How does identity proofing relate to broader compliance and authorization efforts?
Identity proofing generally supports identity and access management objectives that appear within broader control frameworks, such as identification and authentication controls under NIST SP 800-53, but performing proofing is not by itself equivalent to achieving compliance or authorization. Meeting an individual proofing requirement does not substitute for the assessment and authorization processes that govern a system as a whole, and satisfying one program's proofing expectations does not automatically satisfy another's. The precise relationship between proofing requirements and a given control baseline or authorization boundary depends on agency tailoring and the applicable revisions of the relevant publications, which the reader should confirm against current authoritative sources.

Common misconceptions

Identity proofing and authentication are the same thing.
They address different questions and are governed by different parts of the NIST SP 800-63 guidance. Identity proofing establishes, generally at enrollment, that a person is who they claim to be (associated with IAL), while authentication confirms at each access event that the returning subject controls the previously bound authenticators (associated with AAL). Satisfying one does not satisfy the other.
A higher identity assurance level is always required or always better.
The appropriate assurance level is determined by risk and mission need, and agencies may tailor requirements. Selecting an unnecessarily high IAL can introduce friction, privacy exposure, and cost without a corresponding risk reduction. Practitioners should confirm the required level against the applicable authoritative guidance rather than defaulting to the highest tier.
Successful identity proofing means the identity is permanently and fully verified.
Identity proofing is a point-in-time process based on the evidence available at enrollment. It does not guarantee against later account compromise, evidence revocation, or changes in the subject's status, and it does not replace ongoing authentication, monitoring, or reproofing where required by policy.

Best practices

Determine the required Identity Assurance Level based on documented risk and mission need before selecting proofing methods, and confirm the requirement against the applicable revision of NIST SP 800-63A and any agency-specific tailoring.
Keep resolution, validation, and verification as distinct, documented steps so that evidence authenticity checks are not confused with binding the evidence to the presenting person.
Validate identity evidence against authoritative or issuing sources where available rather than relying on visual inspection alone.
Choose remote, in-person, or hybrid proofing methods that are permitted for the applicable assurance level, and verify that the chosen method meets agency requirements before deployment.
Maintain records of the proofing process and evidence handling consistent with applicable privacy and records requirements, and confirm data minimization and retention rules against current authoritative sources.
Treat identity proofing as a point-in-time process, and pair it with ongoing authentication and any required reproofing rather than assuming a one-time proofing result remains sufficient indefinitely.