NIST SP 800-63A is U.S. guidance for identity proofing: the process of establishing that a claimed identity belongs to a real person before that person is enrolled in a digital system. It sits alongside, but is different from, login authentication. Proofing asks, “Is this person who they say they are?” Authentication asks, “Are they the same person returning later?”
This matters in cyber security because weak identity proofing can create account fraud, unauthorized access, bad eligibility decisions, and costly cleanup when records are wrong. The standard helps organizations choose appropriate evidence, verification steps, and assurance levels for the risk involved. In real defenses, it supports onboarding flows, government services, and membership systems that need accurate identity records. In attack scenarios, it helps detect synthetic identities, document fraud, and enrollment abuse before an account or privilege is issued. Good implementations also preserve exception handling, logging, and review paths so automation does not silently approve the wrong person.