Lion Cipher Lab
How strong is strong enough? Choose identity assurance levels with NIST SP 800-63
- Identity & Access Management
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Every security guide ends the same way: turn on MFA, use a security key. What none of them teach is the decision underneath — how much assurance a given system actually needs, and that 'how sure are we who you are' and 'how strong is the login' are two separate dials you set independently. NIST SP 800-63, the U.S. digital-identity standard that much of government and industry builds on, is exactly that framework. Get the decision wrong in one direction and you over-assure: you force a passport scan and a hardware key on a low-stakes newsletter signup, and people abandon it. Get it wrong in…
What you'll learn
- identity assurance levels
- NIST SP 800-63
- IAL vs AAL vs FAL
- risk-based authentication decisions
- phishing-resistant MFA
- mapping authenticators to AAL
- assurance-level worksheets
Steps in this lab
- The question nobody frames: how strong is strong enough?
- The big idea: three separate dials, not one score
- AAL, the practical core: what actually counts as AAL1, AAL2, AAL3
- Why phishing-resistance is the line between AAL2 and AAL3
- IAL and FAL in brief — the other two dials
- A note on revisions: check which SP 800-63 is current
- Set up your worksheet
- Assign the REQUIRED assurance levels (with a justification each)
- Now measure REALITY: what do your current authenticators actually reach?
- When, why, and what's better: reading your own gap column