Identity proofing

Identity proofing verifies that a real person is who they claim to be before an organisation issues them credentials. It happens at registration, the very start of the identity lifecycle: collecting evidence such as passports or driving licences, validating that evidence against authoritative sources, and binding the verified identity to the new account. NIST’s digital identity guidance grades the rigour of this step into identity assurance levels, ranging from self-asserted identity up to verified in-person proofing.

The distinction that matters is proofing versus authentication. Proofing happens once and answers “does this claimed identity belong to this person?”. Authentication happens at every login and answers only “does this subject control the credential we issued?”. Strong multi-factor authentication on top of weak proofing secures the wrong thing: the credential is well protected but may have been issued to an impostor, which is exactly how helpdesk social-engineering attacks defeat otherwise mature single sign-on estates.

Exam relevance: if a scenario mentions verifying documents, checking identity before account creation, enrolment, or registration, the answer is identity proofing. If the scenario involves a login event or presenting credentials, the answer is authentication. Assurance-level questions follow the same split: identity assurance covers proofing rigour, while authenticator assurance covers the strength of the login mechanism itself.