What is identity proofing?
Identity proofing is the process of establishing that an applicant is a specific, real person before an organization gives them an account, a credential or a reset. It happens at enrollment and again whenever credentials are recovered, while authentication happens at every sign-in. The order matters: a strong authenticator such as a FIDO2 key protects nothing if it was handed to an impostor. Banks run their version as know-your-customer checks, employers fold it into hiring, and government services proof people formally before opening tax or benefit records to them.
The three steps in NIST SP 800-63A
- Resolution: gathering identifying details, typically name, birth date and home address, until they point to exactly one person.
- Validation: proving the documents are authentic and their data correct, for example inspecting a driver's license's security features and barcode or checking its details with the issuing agency.
- Verification: linking the applicant to that evidence, for example matching a live selfie video to the document photo.
NIST expresses the strength of the whole process as an identity assurance level: IAL1, IAL2 or IAL3. Each step up demands better evidence and tighter verification, and IAL3 requires a trained proofing agent to attend the session, in person or remotely through a controlled kiosk.
Example: proofing a remote hire
A company hires a systems administrator it has only met over video. Before releasing the first credential, the identity team runs a supervised video session: the new hire holds a passport up to the camera, a document check confirms its security features, a liveness check confirms a real face, and the face is matched to the passport photo and to the person who was interviewed. Only then does the help desk issue a one-time code for MFA enrollment. The precaution is not theoretical. U.S. government advisories since 2022 have warned that North Korean IT workers use stolen or fabricated identities to get hired into remote jobs, then use the access to earn money for the regime and sometimes to steal data.
Proofing at account recovery
The weakest point is usually recovery, not enrollment. An attacker who phones the help desk posing as a locked-out employee is trying to skip proofing entirely, and the 2023 MGM Resorts intrusion was widely reported to have started with exactly such a call. Questions about a pet's name or an employee number fail against anyone who has done basic research, and NIST discourages relying on knowledge-based checks. Safer recovery calls back the number on file in the HR system, confirms the request with the person's manager, asks for an in-person visit, or compares the caller on video with their HR photo before any password or MFA reset.
Identity proofing vs. authentication
Proofing answers "is this applicant really Dana Ortiz?" once, before a credential exists. Authentication answers "is this the same person we issued the credential to?" at every sign-in, using passwords, keys or biometrics. Authorization then decides what Dana may reach. A scenario about issuing or resetting credentials is about proofing even when every answer choice is a type of MFA.
Identity proofing on the CompTIA Security+ exam
Identity proofing is part of SY0-801 objective 4.5, alongside provisioning and deprovisioning accounts. Wording such as "verify a remote new hire before issuing a laptop and credentials," "a caller asks the help desk to reset MFA for an executive" or "confirm a customer's identity when opening an account" points to identity proofing. The tempting wrong answer is a stronger authentication factor, which cannot help if the credential went to the wrong person in the first place. Security questions are another trap, since attackers can often research the answers, and so are stricter password rules, which say nothing about who is asking.