NIST SP 800-63 Digital Identity Guidelines highlight that users need to be segmented by risk, transaction type, and access level. Simply put, different users carry different risks—and that means trust and control must be tailored accordingly.
Here’s how to do it in three steps:1. Segment your users by risk.
2. Assign each group the right level of
Identity Assurance (IAL), Authentication Assurance (AAL), and
Federation Assurance (FAL) if needed.
3. Then dial your security measures accordingly — from simple passwords and SMS to biometric scans and hardware tokens.
An example of customer segmentation by typical risks is given below: