NIST SP 800-63 Digital Identity Guidelines: Proofing, Passwords & MFA

What “NIST Password Guidelines” Cover

Password and authenticator requirements live in SP 800-63B-4. Implementers must follow the normative text for each Authenticator Assurance Level (AAL) — not outdated blog summaries of 800-63-3.

• Passwords remain a supported authenticator type at applicable AALs, with modern composition and verifier rules (favor length and compromised-password screening over arbitrary complexity theater)
• Higher AALs emphasize MFA and phishing-resistant authenticators
• Forced periodic rotation without indication of compromise is not the modern NIST approach — confirm shall-statements in B-4 for your AAL

Why It Matters

“NIST password guidelines” is a high-volume query. Citing the wrong revision (63-3 vs 63-4) creates audit arguments. Pair identity design with CSF PR.AA and SP 800-53 IA.

How CyberSilo Helps

• Compliance Standards Automation — IA / PR.AA policy evidence
• ThreatHawk SIEM — authentication anomaly detection (not a replacement for IdP design)

Frequently Asked Questions

Which NIST document covers passwords?

SP 800-63B-4 (Authentication and Authenticator Management), part of the SP 800-63-4 suite published July 2025.

Is SP 800-63-3 still current?

No. SP 800-63-4 (with A-4, B-4, and C-4) supersedes SP 800-63-3 as of July 2025.

Does NIST ban passwords?

No. Password authenticators remain in scope at applicable AALs; requirements depend on the assurance level and authenticator type.

Related NIST Resources

NIST hub · What Is NIST CSF 2.0? · CSF Function Guides · 800-207 Zero Trust