To combat defense industry fraud and restore trust in government supply chains, an unprecedented paradigm shift is necessary. To do so effectively, hardware-anchored and remotely monitored IAL3 identity proofing must be employed.
CSPs can easily fulfill IAL3 requirements for their customers by using kiosks equipped with hardware cameras and remote agents to meet them. This helps reduce attack surfaces, lower cyber liability insurance premiums and save operational costs through reduced password resets and support calls to call centers.
NIST 800-63-4
NIST 800-63-4, released as the 2025 final edition of its Digital Identity Guidelines, marks a critical transition away from checklist-based requirements to risk-based approaches for Authentication, Assurance and Federation (DIRM). Now emphasizing phishing-resistant authentication protocols with AALs mandating FIDO Passkeys in IAL2 and IAL3; SMS OTPs have been deprecated as organizations seek more resilient methods of multi-factor authentication such as FIDO Passkeys or token-based OTPs.
DIRM now extends beyond enterprise risks to consider impacts on mission delivery, trust and equity among members of society and individual users’ privacy. Organizations must continuously assess threats, service impacts and user populations to select an Identity Assurance Level (IAL), Authentication Assurance Level (AAL) or Federated Assurance Level (FAL).
The AALs provide a measure of confidence that may be placed in an assertion made by one IdP regarding an identity or authentication event. FALs measure the strength of a federation protocol used to securely transfer authentication and attribute information from an IdP to a relying party, using trusted authentication methods delivered over secure protocols. AALs also require the use of a secure credential management infrastructure, while Relying Parties serve to consume authenticated identities to extend trust or access. They connect to IdP via federated security protocol and verify AAL assertions sent from IdP.
FIDO Certified
IAL3 is an intensive verification process designed to safeguard against impersonation attacks such as SIM swapping and MFA bypasses. IAL3 utilizes various methods – direct observation, biometrics and document authentication in live sessions with CSP representatives – in order to combat impersonation attacks such as SIM swapping. By eliminating travel expenses, scheduling issues, attack surfaces and risk exposure associated with establishing trust quickly and cost effectively, this approach significantly decreases time and costs associated with trust building.
Passwordless proofing enabled by FIDO certified nist 800-63-4 ial3 compliance can significantly decrease cyber liability insurance premiums and operational costs by decreasing password resets, while at the same time providing sensitive data within an internal secure perimeter by combining biometrics and cryptographic hardware into one unbreakable barrier against synthetic identities.
The requirements outlined by IAL3 go beyond the usual security specifications of FIDO authenticators devices, which must withstand multiple types of attacks such as malware infections by detecting any evidence of tampering on hardware devices.
The IAL3 standards require that an authenticator implement digital chains of custody in order to prevent it from being compromised by attackers. These include cryptographic hash values used to verify evidence’s integrity; logs with sender/recipient information and timestamped transfers, signatures or acknowledgments from parties transferring/accepting custody transfers, comprehensive notes documenting anomalies, as well as records documenting any special handling considerations or specific handling considerations.
IAL3 Compliant
At its highest level, Identity Verification Level 3 (IAL3) requires physical observation during in-person or remote identification sessions for applicants seeking identity verification. In addition, document authentication methods, facial recognition with liveness detection and comparison to claimed digital identities to minimize impersonation fraud are utilized as part of this process. IAL3 assurance should only be considered for high-risk transactions where an error in identity could cause real world harm, as well as CSP proofing sessions conducted under secure hardware to record biometric evidence collected during these supervised proofing sessions.
For many businesses, IAL3 can be an expensive and labor-intensive process that’s difficult to scale across distributed teams. But in the most sensitive use cases such as account recovery, activating new devices, elevating privilege roles or accessing enterprise applications remotely IAL3 may be necessary to avoid fraud losses and meet non-repudiation standards.
TrustSwiftly’s FIDO Certified passwordless authentication and identity verification platform assists organizations directly meet IAL3 guidelines by offering remote yet supervised IAL3 identity verification processes. TrustSwiftly supports ID&V processes using mobile driver’s license verification as ID&V as well as chat, video and facial recognition with liveness detection capabilities to reduce fraud losses, lower cyber liability insurance premiums and operational expenses by decreasing attack surface areas. Furthermore, its digital chain of custody allows full auditability as well as strong controls against theft of sensitive data.
Remote Proofing
Physical badging creates major vulnerabilities; threat actors may take advantage of one-and-done verification sessions by employing proxy employees or finding ways around it. A continuous IAL3 process, on the other hand, links verified identities with remote locations and eliminates this one-and-done risk created by physical badging.
Trustswiftly helps you meet NIST IAL3 guidelines whether working from home or the field with its remote ID fedramp high identity proofing process that utilizes chat, video and biometric comparison with liveness detection capabilities for liveness detection as well as cryptographic authentication to enhance phishing resistance and man-in-the-middle defense, thus verifying any person claiming to be you and eliminating impersonation fraud while lowering cyber liability insurance premiums.
Agencies can rely on Trustswiftly to facilitate both low-friction and high-risk onboarding, re-verification and account recovery with its FedRAMP-aligned nist ial3 verification at the click of a button. Furthermore, its digital chain of custody tracks who handled what data when to prevent any potential tampering or breaches in records of custody.
Trustswiftly facilitates government access to highly skilled talent by allowing onboarding from home, making the recruitment of highly skilled talent accessible in rural locations, distant bases and those with mobility disabilities. A flexible remote verification framework also enables agency operations to continue operating during natural disasters, wide-scale power outages and other localized threats which might otherwise impede in-person badgering processes and delay critical work.
