Solving NIST Password Complexities: Guidance From a GRC Perspective

This blog post clarifies the context and proper application of NIST SP 800-63 password and digital identity guidance, emphasizing that the guidance is intended primarily for external-facing services and must be applied via a risk-based selection of Identity Assurance Level (IAL), Authentication Assurance Level (AAL), and Federation Assurance Level (FAL). It warns against misapplying the draft guidance to internal systems, reiterates the importance of regulatory requirements and MFA, and advises organizations to perform impact assessments to choose appropriate authentication controls.