NIST SP 800-63 Gap Assessment & Readiness Consulting
We help organizations align with NIST SP 800-63 (IAL, AAL, FAL) requirements and prepare for Kantara Initiative conformance where needed. Our work covers 800-63A (identity proofing), 800-63B (authentication), and 800-63C (federation) across both Revision 3 and the final Revision 4 suite released in July 2025 — as readiness support, not official certification.
Common reasons teams come to us
- A government or regulated relying party requires a specific IAL, AAL, or FAL level.
- A Kantara Initiative conformance assessment is on the horizon and scope is unclear.
- Identity proofing (800-63A) workflows have never been formally reviewed against NIST guidance.
- Authenticator, session, and MFA design (800-63B) needs to move beyond ad-hoc decisions.
- Federation, assertions, and SSO (800-63C) span multiple partners and need a coherent security review.
- The team wants to align FIDO2, OIDC, and SAML choices to 800-63 assurance targets.
- Identity providers (IdPs) and credential service providers (CSPs)
- Federation partners integrating with government or regulated relying parties
- SaaS, fintech, payments, and health-tech IdPs aligning to 800-63 assurance levels
- Regulated B2B teams asked for a specific IAL, AAL, or FAL by a customer
- Teams preparing for a Kantara Initiative conformance assessment
- Target IAL (Identity Assurance Level), AAL (Authenticator Assurance Level), and FAL (Federation Assurance Level) selection
- Gap assessment against NIST SP 800-63-3 and the final SP 800-63-4 suite (July 2025)
- Identity proofing workflow review (800-63A)
- Authenticator, session, and MFA design review (800-63B)
- Federation, assertion, and SSO design review (800-63C)
- Kantara Initiative conformance readiness and evidence preparation
- Alignment with adjacent identity standards (FIDO2, OIDC, SAML)
What 800-63 readiness covers
Assurance-level targeting
Select realistic IAL, AAL, and FAL levels based on relying-party and regulatory needs.
Identity proofing (800-63A)
Review remote and in-person proofing workflows, evidence, and fraud controls.
Authentication (800-63B)
Authenticators, sessions, MFA, recovery, and re-authentication design review.
Federation (800-63C)
Assertion, SSO, and federation architecture review across OIDC and SAML partners.
Kantara conformance readiness
Scope, control mapping, and evidence preparation for a Kantara Initiative assessment.
Adjacent identity standards
Alignment with FIDO2, OIDC, and SAML choices so the identity stack tells one story.
- Target the right assurance levels for your relying parties and use cases
- Enter a Kantara conformance assessment with scope, controls, and evidence organized
- Reduce identity-related risk of account takeover and federation abuse
- Give regulated buyers a clear, standards-based identity posture
- Digital identity scope and assurance-level target
- Gap assessment across 800-63A, 800-63B, and 800-63C
- Remediation roadmap for identity proofing, authentication, and federation
- Kantara conformance evidence plan
Four steps from scope to action
- 01
Define the scope
Confirm identity flows, relying parties, users, and target IAL, AAL, and FAL.
- 02
Assess the environment
Review proofing, authentication, sessions, recovery, and federation against NIST guidance.
- 03
Prioritize the findings
Rank identity gaps by assurance impact, security risk, and implementation effort.
- 04
Deliver the action plan
Provide an engineering and evidence roadmap for the target assurance levels.
Questions we hear most
Explore other ControlSolid services
- Application & cloud security reviews →Architecture and threat modeling for identity providers and federation partners.
- Security assessments & gap analysis →Broader control review that complements 800-63 identity-specific work.
- SOC 2 Type 1 & Type 2 readiness →Common companion for CSPs and IdPs selling into enterprise buyers.