Cybersecurity Policy Report, NIST Unveils Updated Digital Identity Guidelines, (Aug 1, 2025)
Updated recommendations for the use of digital identities by individuals seeking online services from federal government agencies and other organizations were issued today by the National Institute of Standards and Technology.
The recommendations were offered last year for public comment (CPR, Aug. 21, 2024) and represent the first major overhaul of NIST’s digital ID guidance since 2017, according to a blog post.
“These guidelines are ultimately intended to make navigating the digital world more secure and convenient by providing a framework to understand online risks and controls that can better protect our critical online services,” NIST said.
“The rapid proliferation of online services over the past few years has heightened the need for reliable, secure, and privacy-protective digital identity solutions,” NIST noted in the new publication, titled “Digital Identity Guidelines.”
“When confidence in a person’s real-life identity is not required to provide access to an online service, organizations can use anonymous or pseudonymous accounts. In all other use cases, a digital identity is intended to establish trust between the holder of the digital identity and the person, organization, or system interacting with the online service,” NIST explained.
“However, this process can present challenges. There are multiple opportunities for mistakes, miscommunication, and attacks that fraudulently claim another person’s identity,” it said.
“These guidelines define specific assurance levels that operate as baseline control sets. These assurance levels provide multiple benefits, including a starting point for organizations in their risk management journey and a common structure for supporting interoperability between different entities,” it said.
“It is, however, impractical to create assurance levels that can comprehensively address the entire spectrum of risks, threats, or considerations that an organization will face when deploying an identity solution,” NIST added. “For this reason, these guidelines promote a risk-based approach to digital identity solution implementation rather than a compliance-oriented approach, and organizations are encouraged to tailor their control implementations based on the processes defined in these guidelines.”
News: FederalLegislation DataPrivacy DataSecurity