Moving beyond checklists to living digital identity risk management

This article reviews NIST SP 800-63-4’s shift to a Digital Identity Risk Management (DIRM) approach, highlighting changes to Identity Assurance Levels (IAL), Authentication Assurance Levels (AAL), Federation Assurance Levels (FAL), the new Digital Identity Acceptance Statement (DIAS), and AI/ML governance requirements; it urges federal agencies to adopt risk-based tailoring, inventory authenticators, build redress mechanisms, and treat identity programs as continuously evolving to balance security, privacy, and user experience.