Overview

---

Identity Assurance Levels (IALs) are a set of standards defined by the National Institute of Standards and Technology (NIST) that convey the degree of confidence that someone's claimed identity is their real identity — in other words, how likely an individual is actually who they say they are.

The three identity assurance levels, as defined in NIST Special Publication 800-63, are:

Level	Description
IAL1	No requirement to link the individual to a specific real-life identity. Any information provided by the individual should be treated as self-asserted.
IAL2	Uses digital documents to support the real-world existence of an identity and verifies that the correct person is associated with it.
IAL3	Requires an authorized and trained representative to verify the individual in person.

Users can upgrade their own status to IAL2 in AdminX by using the 1Kosmos web-based identity-proofing flow. Tenant and community administrators can trigger this flow using OpenID Connect (OIDC) ACR claims or SAML.

Automated Ways to Get to IAL2

1Kosmos follows guidelines from NIST SP 800-63A for remote identity proofing, attempting to strike a pragmatic balance between availability and convenient access to identity-proofing services and the security of the associated processes.

Several combinations of evidence quality are accepted at IAL2:

• One piece of SUPERIOR or STRONG evidence (depending on the strength of original proof and validation with the issuing source), or

• Two pieces of STRONG evidence, or

• One piece of STRONG evidence plus two pieces of FAIR evidence

Type of Evidence	Strength	Notes
US Passport	SUPERIOR	Includes US Passport cards
Foreign e-Passport	SUPERIOR
Personal Identity Verification (PIV) card	SUPERIOR
Common Access Card (CAC)	SUPERIOR
Personal Identity Verification Interoperable (PIV-I) card	SUPERIOR
Transportation Worker Identification Credential (TWIC)	SUPERIOR
Permanent Resident Card	SUPERIOR	Issued on or after May 11, 2010
Native American Enhanced Tribal Card	SUPERIOR
REAL ID cards	STRONG+	Includes REAL ID driver's licenses and ID cards. REAL ID cards have a star printed in the upper right-hand corner. Card and personal information must be validated with the appropriate DMV or AAMVA.
Enhanced ID cards	STRONG+	Includes Enhanced ID driver's licenses and ID cards. Must be validated with the appropriate DMV or AAMVA.
U.S. Uniformed Services Privilege and Identification Card (U.S. Military ID)	STRONG+	Includes Uniformed Services Dependent ID Cards. Must be validated with the appropriate military issuing source.
Permanent Resident Card	STRONG	Issued prior to May 11, 2010
Native American Tribal Photo Identification Card	STRONG
Driver's License or ID card (REAL ID non-compliant)	STRONG
School ID card	FAIR	Includes facial image photograph
Utility account statement	FAIR
Credit/debit card and account statement	FAIR
Financial institution account statement	FAIR
US Social Security Card	WEAK
Original or certified copy of a birth certificate issued by a state, county, municipal authority, or outlying possession of the United States bearing an official seal	WEAK

1Kosmos provides journeys that allow users to get to IAL2 depending on the evidence collected from them.

In This Section

• IAL2 Verification — Create and manage a one-time IAL2 verification flow.

• One-Time Verification — The end-to-end one-time identity verification journey.

• Triggering IAL2 Verification Using OAuth 2.0 and OIDC — Trigger step-up verification with custom scopes and ACR claims.

• Triggering IAL2 Verification Using SAML — Trigger verification using RequestedAuthnContext.

• Identity Wallet Based Verification — Reuse previously verified identities stored in the user's wallet.