IA-12 Identity Proofing

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	6 (4 in a baseline)

Related controls: AC-5, IA-1, IA-2, IA-3, IA-4, IA-5, IA-6, IA-8, IA-13

Control statement

• a. Identity proof users that require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines;
• b. Resolve user identities to a unique individual; and
• c. Collect, validate, and verify identity evidence.

NIST discussion

Identity proofing is the process of collecting, validating, and verifying a user’s identity information for the purposes of establishing credentials for accessing a system. Identity proofing is intended to mitigate threats to the registration of users and the establishment of their accounts. Standards and guidelines specifying identity assurance levels for identity proofing include SP 800-63-3 and SP 800-63A . Organizations may be subject to laws, executive orders, directives, regulations, or policies that address the collection of identity evidence. Organizational personnel consult with the senior agency official for privacy and legal counsel regarding such requirements.

Control enhancements

IA-12(1) Supervisor Authorization

Baselines: Not in a baseline

Require that the registration process to receive an account for logical access includes supervisor or sponsor authorization.

Discussion and assessment objectives for IA-12(1)

Including supervisor or sponsor authorization as part of the registration process provides an additional level of scrutiny to ensure that the user’s management chain is aware of the account, the account is essential to carry out organizational missions and functions, and the user’s privileges are appropriate for the anticipated responsibilities and authorities within the organization.

Determine if the registration process to receive an account for logical access includes supervisor or sponsor authorization.

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

IA-12(2) Identity Evidence

Baselines: Moderate, High

Require evidence of individual identification be presented to the registration authority.

Discussion and assessment objectives for IA-12(2)

Identity evidence, such as documentary evidence or a combination of documents and biometrics, reduces the likelihood of individuals using fraudulent identification to establish an identity or at least increases the work factor of potential adversaries. The forms of acceptable evidence are consistent with the risks to the systems, roles, and privileges associated with the user’s account.

Determine if evidence of individual identification is presented to the registration authority.

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

IA-12(3) Identity Evidence Validation and Verification

Baselines: Moderate, High

Require that the presented identity evidence be validated and verified through [Assignment: organization-defined methods of validation and verification].

Discussion and assessment objectives for IA-12(3)

Validation and verification of identity evidence increases the assurance that accounts and identifiers are being established for the correct user and authenticators are being bound to that user. Validation refers to the process of confirming that the evidence is genuine and authentic, and the data contained in the evidence is correct, current, and related to an individual. Verification confirms and establishes a linkage between the claimed identity and the actual existence of the user presenting the evidence. Acceptable methods for validating and verifying identity evidence are consistent with the risks to the systems, roles, and privileges associated with the users account.

Determine if the presented identity evidence is validated and verified through [Assignment: organization-defined methods of validation and verification].

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

IA-12(4) In-person Validation and Verification

Baselines: High

Require that the validation and verification of identity evidence be conducted in person before a designated registration authority.

Discussion and assessment objectives for IA-12(4)

In-person proofing reduces the likelihood of fraudulent credentials being issued because it requires the physical presence of individuals, the presentation of physical identity documents, and actual face-to-face interactions with designated registration authorities.

Determine if the validation and verification of identity evidence is conducted in person before a designated registration authority.

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

IA-12(5) Address Confirmation

Baselines: Moderate, High

Require that a [Selection: registration code; notice of proofing] be delivered through an out-of-band channel to verify the users address (physical or digital) of record.

Discussion and assessment objectives for IA-12(5)

To make it more difficult for adversaries to pose as legitimate users during the identity proofing process, organizations can use out-of-band methods to ensure that the individual associated with an address of record is the same individual that participated in the registration. Confirmation can take the form of a temporary enrollment code or a notice of proofing. The delivery address for these artifacts is obtained from records and not self-asserted by the user. The address can include a physical or digital address. A home address is an example of a physical address. Email addresses and telephone numbers are examples of digital addresses.

Determine if a [Selection: registration code; notice of proofing] is delivered through an out-of-band channel to verify the user’s address (physical or digital) of record.

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

IA-12(6) Accept Externally-proofed Identities

Baselines: Not in a baseline

Accept externally-proofed identities at [Assignment: organization-defined identity assurance level].

Discussion and assessment objectives for IA-12(6)

To limit unnecessary re-proofing of identities, particularly of non-PIV users, organizations accept proofing conducted at a commensurate level of assurance by other agencies or organizations. Proofing is consistent with organizational security policy and the identity assurance level appropriate for the system, application, or information accessed. Accepting externally-proofed identities is a fundamental component of managing federated identities across agencies and organizations.

Determine if externally proofed identities are accepted [Assignment: organization-defined identity assurance level].

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security responsibilities; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

Assessment objectives (SP 800-53A)

Objectives and methods for IA-12

Determine if:

• IA-12a. users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity proofed;
• IA-12b. user identities are resolved to a unique individual;
• IA-12c.
  • IA-12c.[01] identity evidence is collected;
  • IA-12c.[02] identity evidence is validated;
  • IA-12c.[03] identity evidence is verified.

Examine: Identification and authentication policy; procedures addressing identity proofing; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with system operations responsibilities; organizational personnel with information security and privacy responsibilities; legal counsel; system/network administrators; system developers; organizational personnel with identification and authentication responsibilities.

Test: Mechanisms supporting and/or implementing identification and authentication capabilities.

Policy statement

• The Account manager shall identity proof users who require accounts for logical access, at the identity assurance level the applicable standards require, such as the NIST SP 800-63-4 digital identity guidelines. (IA-12a)
• The Account manager shall resolve each user identity to a unique individual. (IA-12b)
• The Account manager shall collect, validate and verify identity evidence. (IA-12c)

IA-12(2) Identity evidence

• The Account manager shall require evidence of individual identification to be presented to the registration authority. (IA-12(2))

IA-12(3) Identity evidence validation and verification

• The Account manager shall require presented identity evidence to be validated and verified through Fill in: methods of validation and verification of identity evidence Typical: checking the evidence against its issuing or an authoritative source, and confirming the applicant is the person it describes. (IA-12(3))

IA-12(4) In-person validation and verification

• The Account manager shall require validation and verification of identity evidence to be conducted in person before a designated registration authority. (IA-12(4))

IA-12(5) Address confirmation

• The Account manager shall require a Select one: registration code; notice of proofing Typical: registration code to be delivered through an out-of-band channel to verify the user’s address of record, physical or digital. (IA-12(5))

From the Identification and Authentication Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

IA-12 asks you to confirm that people are who they claim to be before they get an account. NIST SP 800-63A-4 (July 2025) sets the method: resolve the claimed identity to one person, validate the evidence, and verify the applicant is its owner. It also defines three identity assurance levels (IAL1 to IAL3). Choose a level for each group of users through the risk process in SP 800-63-4 (Section 3).

Common implementations. For the workforce, HR examines identity documents during hiring. IT creates accounts only against the HR record, after screening and an approved access request, the order the onboarding, transfer and termination checklist sets. Remote hires are proofed through a supervised remote session or an identity proofing service at IAL2. The help desk proofs again before replacing a lost authenticator. For the public, an external credential service provider proofs users at the chosen level. For IA-12(5), the confirmation codes in SP 800-63A-4 (Sec. 3.8) do the job of a registration code: at least 6 digits, valid for at most 10 minutes by phone or 24 hours by email. SP 800-63A-4 also requires a notification of proofing sent to a validated address at every level (Sec. 3.10). The Identification and Authentication policy states the requirements.

Organization-defined parameters. The base control has none. Typical values, taken from the IA policy, which your organization may set differently:

Parameter	Typical value
Methods of validation and verification (IA-12(3))	Checking the evidence against its issuing or an authoritative source, and confirming the applicant is the person it describes
Address confirmation (IA-12(5))	Registration code

Evidence assessors ask for.

• The identity proofing procedure, naming the assurance level for each group of users
• Proofing records for a sample of accounts: the evidence presented, how it was validated, and who verified it
• The contract or assessment showing an external proofing service’s assurance level, where one is used
• Records of registration codes or notices sent to the address of record
• Help desk records showing proofing before an authenticator is reissued

Inheritance. The HR onboarding process, a badge or credential office, or an external proofing service usually provides proofing as a common control. The system owns any group of users it enrolls itself, and the assurance level it requires of each group.

Common findings.

• Accounts created from an email request with no proofing record.
• Remote hires given accounts before anyone has checked their identity.
• Help desk resets granted on knowledge questions such as a date of birth.
• Copies of identity documents kept longer than needed, a privacy risk to raise with the privacy office.

Enhancements in the Moderate baseline. IA-12(2) identity evidence, IA-12(3) identity evidence validation and verification and IA-12(5) address confirmation. High adds IA-12(4) in-person validation and verification.

Federal systems (as of September 2026). FIPS 201-3 (January 2022, Section 2.7) sets PIV identity proofing as a tailored IAL3 process. The applicant appears in person at least once and presents two original identity source documents, at least one of them Strong evidence under SP 800-63A. SP 800-63A-4 (Sec. 3.7) requires agencies to consult their Senior Agency Official for Privacy and to publish a system of records notice and a privacy impact assessment for proofing collections, as applicable. For public-facing services, OMB M-26-18 (August 31, 2026) requires Login.gov’s identity verification unless it does not meet the service’s requirements.

Artifacts

• Identification and Authentication Decision Worksheet
• Identification and Authentication Policy
• Identification and Authentication Standard