IAL3 Identity Proofing, Certified. Not Self-Attested.
NextgenID is the only U.S. provider independently audited and Kantara-certified to IAL3. We run the proofing, hold the certification, and keep the evidence, so you meet the mandate with a document, not a build project.
Why IAL3 Exists
Self-Attested Proofing Is Only as Strong as the Audit It Has Not Had.
Most vendors attest to their own conformance. They tell you they are aligned with NIST 800-63, but no independent body has verified it, and the burden of proving it lands on you at audit time.
Certified IAL3 removes that risk. The proofing is independently audited, the assurance level is established, and the evidence is retained, so your answer to prove it is a certification, not a scramble.
3 of 3
IAL3 is the highest of the three identity assurance levels defined in NIST SP 800-63.
Only 1
The only Kantara-certified IAL3 identity proofing provider in the United States.
Mandatory
FedRAMP High requires IAL3 for privileged users; IAL2 is a Not Satisfied finding.
Zero
Deepfake incidents across NextgenID's deployed identity-proofing network.
If your mandate requires IAL3, only independently certified proofing closes the gap.
How IAL3 Enrollment Works
One session, one certified chain of custody, and one accountable provider for the whole stack: hardware, software, trained operators, and the credential. Not five vendors and an integration project you own every seam of.
From arrival to credential, every step is supervised, captured on certified hardware, and mapped to the standard.
Walk in at any station on the nationwide PresenceID network, or on your own site
Document authentication on integrated, tamper-evident scanners
Face, iris, and fingerprint capture on certified biometric hardware
Live operator supervises the full session and challenges anomalies in real time
Verified identity bound to a credential, with audit-ready evidence retained
What IAL3 Requires
A webcam and a checklist do not qualify.
NIST SP 800-63A sets specific requirements for the highest identity assurance level, and a browser webcam with a document upload does not meet them. An injected camera feed or a deepfake passes an unsupervised check silently, and no one knows until the fake identity is already inside. Meeting IAL3 takes supervised proofing, biometric capture on tamper-evident hardware rather than in the browser, and independent certification, not self-attestation.
The requirements
A live, trained operator inspecting evidence in person or by supervised remote session
Physical inspection of government-issued identity documents
Biometric capture bound to the individual
Tamper-evident capture hardware at the point of enrollment
Independent certification of the whole process, not self-attestation
Mandated or mission-driven, IAL3 proofing done right the first time.
Who Needs IAL3
Built for Missions Where an Unverified Identity Is a Breach.
Federal agencies, cloud providers in FedRAMP High scope, prime and subcontractors, and GovTech vendors turn to NextgenID when a contract, an audit, or a mandate requires certified IAL3.
- Identity established once, certified, and reusable across your workflows
- Evidence retained under our certification and produced on demand
- A credential bound to a verified human, not a self-asserted claim
Whether the driver is a FedRAMP authorization, a PIV-I obligation, or a fraud incident, the requirement is the same: certified IAL3.
Where IAL3 Is Required
Real Mandates That Demand Certified Proofing
These are not hypothetical. They are live obligations where IAL2 fails the assessment and only certified IAL3 clears it.
| Workflow | The Risk Without Verified Identity | NextgenID’s Role |
|---|---|---|
| PIV & PIV-I Credential Issuance | An impersonated employee receives a trusted federal credential, and every downstream system inherits the fraud | Supervised IAL3 proofing and same-session PIV and PIV-I credential issuance in the same session |
| Federal Workforce & Distributed Hiring | Remote hires proofed by selfie: deepfakes pass liveness checks and synthetic identities get onboarded | Supervised remote sessions at walk-in, on-site, or mobile stations near each employee |
| FedRAMP High Cloud Access | Unauthorized privileged users in federal cloud environments, where IAL3 is mandated | IAL3 enrollment and PIV-I credential issuance through the PresenceID™ Network |
| Defense & Cleared Facility Access | An unverified identity gains physical and logical access where national security is at stake | IAL3 multi-modal biometric enrollment before any badge or system credential is issued |
| Contractor & Gig Onboarding | Synthetic workers gain access to sensitive systems and data undetected | IAL3 proofing at onboarding: every worker verified before a single credential is issued |
| CJIS & Law Enforcement System Access | Unverified access to criminal justice information systems and data | Supervised IAL3 proofing that satisfies CJIS identity requirements with one credential |
| Nationwide Benefits & Citizen Enrollment | Fraudulent enrollment diverts benefits and services at population scale | The model HHS uses: supervised enrollment infrastructure deployed nationwide |
| High-Risk Account Changes & Re-Verification | Account takeover at password reset, payee change, or privilege escalation | Identity re-proofing at a PresenceID™ station before the change is authorized |
Enrollment Options
Choose Your Enrollment Model
Same certified IAL3 assurance, delivered the way your operation needs it.
PresenceID Network Enrollment
IAL3 identity proofing available to your enrollees — wherever they are.
No dedicated hardware. No central enrollment facility. Enrollees go to the nearest PresenceID™ network location and complete a supervised IAL3 session with a certified agent via secure connection. You get verified, audit-ready identity data without the capital investment or operational overhead of running your own enrollment infrastructure.
- Real-time certified agent supervision
- No hardware purchase required
- Nationwide network access, walk-in available
- Encrypted, audit-ready enrollment packages delivered to your CMS
Enrollee visits the nearest network location
Connects securely with a certified remote agent
Completes supervised biometric and document capture
Verified identity package delivered to your system for adjudication
Kantara IAL-3 Certified
Independently certified to the highest identity assurance level under NIST 800-63.
Compliance Is Not a Feature.
It Is the Foundation.
We are independently audited and certified. Our Kantara IAL-3 certification means you can rely on our identity proofing for the most demanding enterprise and regulatory applications.
Get the Compliance GuideSee Certified IAL3 End to End
Request a demo and watch certified proofing from arrival to credential issuance.
// WHO WE SERVE
High-Assurance Identity for Every Mission
From federal agencies to regulated enterprises, wherever IAL3 is required, NextgenID delivers it certified.
Federal & Government
Civilian agencies, PIV and PIV-I, federal workforce.
Defense & National Security
DoD, classified access, intelligence community, CJIS.
Regulated Industries
Financial services, healthcare, cloud/FedRAMP, KYC/AML — any industry with a compliance mandate.
Enterprise & Workforce
Commercial enterprises, remote teams, mass hiring, contractor/vendor onboarding.
Identity-Gated Workflows
Proof identity once, then gate any transaction, access decision, or service that requires it.
Meet the Mandate with Certified IAL3.
Talk to NextgenID about certified identity proofing delivered as a service, not a build project.