Before you give someone an account, how do you know who they are? IA-12 Identity Proofing is the control for that question. It sits at registration, not at login, and it exists to reduce the risk of a fake or stolen identity becoming a trusted user.
800-53 binds US federal systems and contract holders. For other companies it is a reference. Remote hiring and contractor onboarding have made the question more common in audits.
What the control asks
Identity proof users who need accounts for logical access, based on the identity assurance level your applicable standards require. Resolve each identity to a unique individual. Collect, validate and verify identity evidence. NIST points to SP 800-63-3 and SP 800-63A for the assurance levels.
What it means in practice
For a company this usually means a defined onboarding step: collect a government ID or equivalent evidence, check it is genuine, and confirm the person matches it. Employers often do this through HR and background screening. Customer facing products may need it for high risk roles, such as an administrator of a regulated tenant.
Evidence to collect
- The onboarding procedure that states which evidence is accepted at which access level.
- Records that show the check happened, such as a completed verification or an I-9 style record held by HR, without copying sensitive documents into the audit folder.
- A sample of recent hires or contractors traced from request to verified identity to account creation.
Common gaps
Remote contractors given access before verification. Verification done once and not repeated when someone moves to a more privileged role. Evidence stored in an insecure place.
The enhancements show how far it can go: IA-12.1 Supervisor Authorization, IA-12.2 Identity Evidence, IA-12.3 Identity Evidence Validation and Verification, IA-12.4 In-person Validation and Verification, IA-12.5 Address Confirmation and IA-12.6 Accept Externally-proofed Identities.
How to implement it
Tie account creation to a verification status in your HR or ticketing flow. Define the evidence per access tier. Keep proof of completion, not copies of documents, wherever the law allows.
Quick check
Is IA-12 about login strength?
No. It is about verifying a person's identity when you establish their account. Login strength belongs to IA-2 and IA-5.
