NIST SP 800-63, Revision 2 can be found at the following URL: Review Maximum Potential Impact Levels has assessed the potential risk from E-Authentication errors, or E-Authentication misuse, related to a user’s asserted identity. has taken into consideration the potential for harm (impact) and the likelihood of the occurrence of the harm and has identified an impact profile as found in Table 153 Potential Impacts for Assurance Levels. Assurance is defined as 1) the degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. Table 153 Potential Impacts for Assurance Levels Assurance Level Impact Profile Potential Impact Categories 1 2 3 4 Inconvenience, distress or damage to standing or reputation Low Mod Mod High Financial loss or agency liability Low Mod Mod High Harm to agency programs or public interests N/A Low Mod High Unauthorized release of sensitive information N/A Low Mod High Personal Safety N/A N/A Low Mod, High Civil or criminal violations N/A Low Mod High E-Authentication Level Selection Instruction: Select the lowest level that will cover all potential impact identified from Table 153 Potential Impacts for Assurance Levels. Delete this instruction from your final version of this document. The has identified that they support the E-Authentication Level that has been selected for the as noted in Table 154 E-Authentication Level. The selected E-Authentication Level indicated is supported for federal agency consumers of the cloud service offering. Implementation details of the E-Authentication mechanisms are provided in the System Security Plan under control IA-2 Table 154 E-Authentication Level E-Authentication Level Maximum Impact Profile Selection Level 1: no identity proofing requirement Low Level 2: single factor remote authentication Low Level 3: multi-factor remote authentication Moderate
NIST SP 800-63, Revision 2 can be found at the following URL: Review Maximum Potential Impact Levels has assessed the potential risk from E-Authentication errors, or E-Authentication misuse, related to a user’s asserted identity. has taken into consideration the potential for harm (impact) and the likelihood of the occurrence of the harm and has identified an impact profile as found in Table 153 Potential Impacts for Assurance Levels. Assurance is defined as 1) the degree of confidence in the vetting process used to establish the identity of the individual to whom the credential was issued, and 2) the degree of confidence that the individual who uses the credential is the individual to whom the credential was issued. Table 153 Potential Impacts for Assurance Levels Assurance Level Impact Profile Potential Impact Categories 1 2 3 4 Inconvenience, distress or damage to standing or reputation Low Mod Mod High Financial loss or agency liability Low Mod Mod High Harm to agency programs or public interests N/A Low Mod High Unauthorized release of sensitive information N/A Low Mod High Personal Safety N/A N/A Low Mod, High Civil or criminal violations N/A Low Mod High E-Authentication Level Selection Instruction: Select the lowest level that will cover all potential impact identified from Table 153 Potential Impacts for Assurance Levels. Delete this instruction from your final version of this document. The has identified that they support the E-Authentication Level that has been selected for the as noted in Table 154 E-Authentication Level. The selected E-Authentication Level indicated is supported for federal agency consumers of the cloud service offering. Implementation details of the E-Authentication mechanisms are provided in the System Security Plan under control IA-2 Table 154 E-Authentication Level E-Authentication Level Maximum Impact Profile Selection Level 1: no identity proofing requirement Low Level 2: single factor remote authentication Low Level 3: multi-factor remote authentication Moderate