What Is Zero Trust? The Basics Explained
As government services move online and across systems, Zero Trust becomes essential to ensuring every interaction is secure and verifiable.
Identity proofing is the process by which an organization verifies that a person is who they claim to be before issuing a credential or granting access to a service. It is the foundational step that makes everything downstream trustworthy. Without it, a government agency has no reliable basis for the credentials it issues, the benefits it disburses, or the services it makes available online. For those evaluating digital identity programs, understanding identity proofing is not optional, it is the starting point.
Identity Proofing Is Not the Same as Authentication
These two terms are sometimes used together, but they describe different stages of an identity system, and conflating them creates real risk in program design.
Identity proofing occurs once or periodically at the beginning of a relationship. It answers the question: Is this person actually who they say they are? It involves collecting evidence (a driver's license, a passport, biometric data) and validating that evidence against authoritative sources.
In contrast, authentication happens every time. It answers a different question: Is the person requesting access right now the same person we already verified? Authentication relies on credentials issued after proofing. A password, a one-time code, or a digital certificate are authentication mechanisms. They only carry trust if the identity behind them was proven rigorously in the first place.
Think of proofing as the interview and authentication as the badge swipe. One determines eligibility; the other enforces it. For government services, this distinction shapes procurement, vendor selection, and system architecture.
The Three NIST Identity Assurance Levels
NIST SP 800-63-4, the federal framework that governs digital identity for government programs, defines three Identity Assurance Levels (IALs). Each level represents a different degree of confidence that a claimed identity corresponds to a real, unique individual in the real world.
IAL1 requires no identity proofing. Users self-assert their identity without providing evidence that it corresponds to a real, unique individual. This level is appropriate for low-risk use cases where anonymity or pseudonymity is acceptable, such as public comments or basic account creation. There is no binding between the credential and a verified real-world identity. While IAL1 minimizes friction, it also provides no protection against synthetic identity creation or automated enrollment fraud.
IAL2 requires identity proofing that establishes high confidence in the applicant’s real-world identity. Proofing can be performed remotely or in person and involves collecting identity evidence, validating it against authoritative or credible sources, and verifying that the applicant is the legitimate owner of that evidence (for example, through biometric or liveness checks). IAL2 is the baseline for most government benefit programs, professional licensing, and services that involve sensitive personal data.
IAL3 requires the highest level of assurance, including attended proofing and biometric binding. A trained proofing agent must supervise the process, either in person or through a controlled remote environment. IAL3 is reserved for high-risk use cases, such as access to critical infrastructure, credentialing with legal authority, or scenarios where identity fraud would have severe consequences. While more resource-intensive, it provides the strongest defense against impersonation and identity fraud.
Choosing the wrong IAL in either direction carries costs. Overbuilding proofing for low-risk services creates friction that drives users away from digital channels. Underbuilding it for high-risk services can create fraud exposure and regulatory liability.
Common Identity Proofing Methods
Agencies have three primary approaches, each with different trade-offs in assurance, cost, and accessibility.
In-person proofing remains the gold standard for high-assurance use cases. A trained operator examines physical identity documents and may collect biometrics. The limitation is scale. In-person proofing requires physical infrastructure, staff time, and creates friction for applicants who cannot easily travel to a government office.
Remote identity proofing has matured significantly and now supports IAL2 at scale. Users submit their identity documents and capture a selfie or undergo a liveness check to confirm that the document belongs to them. Automated systems check document authenticity against known templates and issuer databases.
Document-based proofing is a component of both in-person and remote workflows. It centers on validating a physical or digital identity document such as a passport, a REAL ID-compliant driver's license, or increasingly, a mobile driver's license (mDL).
Choosing the Right Proofing Level for Your Agency
There is no universal answer, and the frameworks are explicit about this. NIST 800-63-4 requires agencies to conduct a Digital Identity Risk Assessment before selecting an IAL. That assessment weighs the potential harms of identity fraud or misidentification against the costs of stronger proofing, including accessibility barriers that may disproportionately affect underserved populations.
A few practical questions help frame the decision:
- What is the consequence if someone fraudulently obtains this credential or accesses this service? Financial harm, public safety risk, and data exposure each suggest higher assurance requirements.
- What is the consequence if a legitimate user cannot complete proofing? Programs that serve populations with limited document access, low digital literacy, or disabilities may need to preserve in-person pathways even as they scale remote options.
- What existing authoritative sources can the agency query? Proofing is faster and more reliable when agencies can validate evidence against state records, federal databases, or trusted third-party registries.
- What credentials will be issued downstream? If the proofed identity will anchor a long-lived verifiable digital credential (especially one accepted by other agencies or jurisdictions), higher assurance at proofing time protects the entire ecosystem that the credential enters.
For state agencies building or modernizing identity programs, aligning proofing architecture to NIST SP 800-63-4 is both a compliance consideration and a trust signal to federal partners, other states, and residents. Building that foundation correctly from the start is far less costly than retrofitting it later.
From Proofing to Trust at Scale
Identity proofing is not just a compliance checkbox, it is the trust layer that determines whether digital government services can scale securely and inclusively. As agencies navigate evolving standards such as NIST SP 800-63-4 and balance assurance with accessibility, the right infrastructure and partners make all the difference.
SpruceID helps governments implement flexible, standards-aligned identity infrastructure. If you’re building or modernizing your identity program, now is the time to get the foundation right. Learn more about how SpruceID can help.
Building digital services that scale take the right foundation.
About SpruceID: SpruceID builds digital trust infrastructure for government. We help states and cities modernize identity, security, and service delivery — from digital wallets and SSO to fraud prevention and workflow optimization. Our standards-based technology and public-sector expertise ensure every project advances a more secure, interoperable, and citizen-centric digital future.
