scope:

This Recommendation provides a framework for managing entity authentication assurance (EAA) in a given context. In particular, it:

- establishes three entity authentication assurance levels (AALs);

- gives guidelines for understanding these entity AALs;

- specifies criteria and guidelines for achieving identified levels of EAA;

- provides guidance for comparing and mapping across authentication assurance schemes;

- provides guidance for exchanging the results of authentication that are based on specific assurance levels; and

- provides guidance concerning controls that should be used to mitigate authentication threats, based on a risk assessment.