Free tools Windows power users keep installed
One-click scans. No signup required.
Identity and access management (IAM) is the organizational capability for managing digital identities and controlling their access to systems and resources. In NIST’s concise formulation, IAM helps ensure “the right people and things have the right access to the right resources at the right time.”
What identity and access management includes
IAM connects two concerns: representing digital identities and governing what those identities can access. It can apply to people and to non-human entities such as devices or other things that interact with systems. An identity does not necessarily have to reveal a person’s real-world identity; it can be unique within a service without being traceable to a particular individual.
As an Amazon Associate I earn from qualifying purchases.
IAM is broader than a login screen. Digital identity work can involve establishing identity claims, enrolling an identity, managing authenticators, authenticating a claimant, and sharing identity assertions with other services. NIST’s current Digital Identity Guidelines, SP 800-63 Revision 4, organizes guidance across these areas. It is intended for interactions with government information systems, not as a universal blueprint for every organization’s IAM program.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteAuthentication and authorization are different
Authentication asks whether a claimant controls the authenticator associated with the digital identity they are claiming. Authorization asks whether that authenticated subject is allowed specified access to a resource. Authentication establishes who or what is making a claim; authorization determines what that subject may do.
#1 Best Overall
For example, signing in successfully to a work application is an authentication event. Whether the signed-in identity may view a particular file is an authorization decision. The two are related, but one does not automatically determine the other.
Identity proofing, authenticators, and federation
Identity proofing and enrollment
Identity proofing establishes or assesses an applicant’s claimed identity as part of enrollment. What information is collected and how thoroughly a claim is checked depend on the service and its requirements.
Rank #2
Authenticators and authentication
An authenticator is a means of demonstrating control or possession of one or more factors in an authentication protocol. A password and a device containing a cryptographic key are examples of different kinds of authentication evidence. NIST’s guidance also discusses authenticator management and properties such as phishing resistance.
Federation
Federation allows identity information or authentication results to be asserted to another service. This can let a relying service use an assertion from another identity system rather than independently carrying out every identity interaction. NIST SP 800-63-4 includes federation and related assertions in its scope.
How multi-factor authentication works
Multi-factor authentication (MFA) requires more than one distinct factor type. NIST identifies three categories:
- Something you know: for example, a password.
- Something you have: for example, a device containing a cryptographic key.
- Something you are: for example, biometric characteristic data.
Using two passwords still uses only the knowledge factor, so it is not MFA. A password combined with a distinct possession or inherence factor uses more than one factor type. The specific authenticator and its compatibility with an organization’s systems and requirements matter; a security key by itself is not an IAM program.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What NIST SP 800-63 Revision 4 covers
NIST released SP 800-63 Revision 4 on August 1, 2025, superseding Revision 3. Its parts divide the guidance by subject:
- SP 800-63A: identity proofing and enrollment.
- SP 800-63B: authentication and authenticator management.
- SP 800-63C: federation and assertions.
The suite addresses digital identity interactions with government information systems. NIST says it is not intended to constrain standards outside that purpose. Organizations can use its subject areas to understand the breadth of digital identity work, while recognizing that the suite is not a complete organizational IAM implementation blueprint.
What IAM means in organizational practice
IAM brings identity management and access decisions together. In practical terms, an organization needs to consider which identities its systems recognize, how claimants demonstrate control of those identities, and which resources those identities may access. The exact governance, policies, and technical design depend on the organization’s services, risks, and privacy and usability needs; the NIST digital identity guidance does not prescribe one architecture for all organizations.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
