NIST SP 800-63 Rev.4 certification

Kantara Initiative assesses and certifies identity services against NIST Special Publication 800-63 Revision 4 through the Kantara Initiative International Assurance Program (KIIAP). Kantara has published Service Assessment Criteria (SAC) and Statements of Criteria Applicability (SoCA) for the Revision 4 Base Volume, SP 800-63A-4 and SP 800-63B-4. This page brings together the criteria, the approval process and the contacts you need to get started.

What NIST SP 800-63 Revision 4 covers

NIST SP 800-63 Revision 4 was published in 2025. Kantara’s Revision 4 criteria follow the structure of the NIST suite:

  • Base Volume: Kantara’s 63-4 Base Volume SAC sets the organizational criteria that apply to every service assessed under Revision 4, whatever its identity function or assurance level.
  • SP 800-63A-4, Identity Proofing: criteria at the applicable Identity Assurance Levels (IAL).
  • SP 800-63B-4, Authentication and Lifecycle Management: criteria at the applicable Authenticator Assurance Levels (AAL).
  • SP 800-63C-4, Federation and Assertions: the Base Volume SAC is used together with the 63A-4, 63B-4 and 63C-4 criteria. Kantara’s public review notice says draft criteria for 63C-4 will be released next.

Kantara criteria for Revision 4

The SP 800-63A-4 and SP 800-63B-4 criteria were finalized after a public review and comment period. The Base Volume was finalized and approved under the Kantara Initiative criteria development process. Each set took effect on publication:

  • KIIAP 14-00, 63-4 Base Volume SAC and SoCA (v1.0, June 2026). This sets out the organizational criteria for all Revision 4 assessments. It supersedes the Common Organizational SAC (CO_SAC, KIAF-1410) for Revision 4 assessments only, and CO_SAC must not be applied within a Revision 4 assessment.
  • KIIAP 14-01, SP 800-63A-4 SAC and SoCA (v1.0, March 2026). Identity Assurance Level assessments can be carried out against SP 800-63A-4.
  • KIIAP 14-02, SP 800-63B-4 SAC and SoCA (v1.0, May 2026). Authenticator Assurance Level assessments can be carried out against SP 800-63B-4.

To get a criteria document, complete the request form on its download page. For the latest publications and clarifications, see Kantara Notices.

How Revision 3 and Revision 4 relate

Both the Revision 3 and the Revision 4 criteria suites remain available to service providers. The Revision 4 publication notices say that:

  • Where no mandate requires Revision 4, service providers may continue to be assessed and certified under Revision 3. They are encouraged to move to Revision 4.
  • The earlier SP 800-63A-3 and SP 800-63B-3 assessment criteria remain available to those who need them.
  • CO_SAC remains in force as the organizational criteria set for assessments under Revision 3.
  • Trust Mark holders and registered applicants are encouraged, but not required, to move to the Revision 4 criteria when they renew.
  • Holders of a NIST 800-63 rev.3 (Technical) Trust Mark remain validly certified for the full term of their current three-year cycle. The Classes of Approval page says the Technical Class of Approval will be discontinued with the release of Kantara’s Revision 4 criteria.

The site does not set a deadline for moving from Revision 3 to Revision 4. If you hold a Trust Mark or are a registered applicant and have questions about your own transition, contact the Assurance Program team at [email protected].

The approval process

The Assurance Program Approval Process covers applications under both Revision 3 and Revision 4:

  • Understand the requirements: Choose your Class of Approval. Decide whether you are certifying a Full Service or a Component Service, which criteria set applies (Revision 3 or Revision 4), and which assurance levels you are aiming for. Read the Service Approval Handbook and the Trademark License Agreement.
  • Prepare for assessment: Review the SAC that apply to your class and prepare your SoCA. If you are applying under Revision 4, also prepare a short risk narrative (DIRM) explaining how you chose your assurance levels.
  • Submit your application: Send the Application for Certification, the service description (S3A), your SoCA and, if applicable, your DIRM narrative. Once your application is accepted, your service is listed on the Trust Status List as a Registered Applicant.
  • Complete your assessment: Kantara assigns a Kantara Accredited Assessor, who reviews your service against the criteria and produces an assessor report (KIAR) and Statement of Conformity.
  • Certification decision: An independent Assurance Review Board (ARB) review team reviews the completed package and makes the certification decision.
  • Trust Mark: Once certified, you sign the Trademark License Agreement and your service is published on the Trust Status List. Certification runs on a three-year cycle, with annual reviews in years two and three.

Ready to Operate pathway

If your service is not live yet, the Approval Process page says you can still apply through the Ready to Operate pathway. The Classes of Approval page, which currently describes the Revision 3 classes, lists Ready to Operate and Full Approval as the available assessment modes. If you are unsure about your scope, contact the Secretariat before you apply.

Accredited assessors

Organizations seeking assessment and certification now contract directly with Kantara Initiative. Kantara manages the engagement and assigns accredited assessors. You can say which assessor you would prefer, but Kantara makes the assignment so that the process stays impartial. The Assessor Assignment Policy (Notice KI#2026-02) sets out the basis for this approach in ISO/IEC 17065:2012. For more information, see Kantara as assessors and For Assessors.

Passkeys and syncable authenticators

Notice KI#2026-01, dated 9 April 2026, supersedes the earlier passkey accommodation notice, KI-2024-01. Kantara has added requirements derived from NIST SP 800-63B Revision 4 Appendix B (Syncable Authenticators) to its 63B SAC catalog as explicit, assessable criteria. Assessors evaluate passkey implementations against these criteria in the same way as other applicable controls. New assessments started on or after 9 April 2026 use the updated 63B SAC criteria for passkey implementations. Assessments already in progress on that date may continue under KI-2024-01 or adopt the updated criteria by agreement between the service provider and the assessor. The notice describes this update as part of the Revision 3-based 63B assurance program, informed by Revision 4 Appendix B.

Fees

Revision 4 has its own fee schedule, separate from the Revision 3 and accredited assessor fees. For current amounts, see the NIST Revision 4 Fees section of Assurance Program Fees.

Trust Status List

The Trust Status List lists approved Trust Mark holders, Registered Applicants and Accredited Assessors in Kantara’s international Identity Assurance Program.

Key documents

Get started

Send initial applications for Revision 4 assessment to [email protected]. The same address handles questions about implementation or transition. For general enquiries, use the contact form. For an overview of the programme, return to the International Identity Assurance Program.