ISO/IEC 29115 — Entity Authentication Assurance Framework

Understanding Entity Authentication Assurance Levels

ISO/IEC 29115 provides a framework for entity authentication assurance, defining a hierarchy of assurance levels that can be applied across different systems, organizations, and jurisdictions. In an increasingly interconnected digital world, establishing confidence in the identity of remote entities — whether users, devices, or services — is fundamental to security. The standard defines four levels of authentication assurance (LoA), each specifying the rigor required for identity proofing, credential management, and authentication mechanisms. The framework is designed to be technology-neutral and scalable across different risk environments, from low-risk consumer applications to high-security government systems.

The standard distinguishes between three distinct phases of the authentication lifecycle: identity proofing (establishing that an entity is who they claim to be), credential management (issuing, storing, and revoking authentication tokens), and authentication mechanisms (the actual verification process). Each phase has independent assurance level requirements that together determine the overall authentication assurance. This separation is critical because weaknesses in any single phase can undermine the entire authentication chain — for example, a strong multi-factor authentication mechanism provides little protection if the initial identity proofing was fraudulent.

A key engineering consideration in the standard is the concept of “applicability scope” — the standard recognizes that different transactions within the same system may require different assurance levels. A user viewing their account balance may only need LoA 2, while the same user initiating a wire transfer over $10,000 may require LoA 3. The standard provides guidance on implementing risk-based, context-aware authentication that adapts assurance requirements based on transaction value, data sensitivity, and historical user behavior patterns.

The Four Levels of Authentication Assurance

Level 1: Little or No Confidence

LoA 1 provides minimal assurance of identity. No identity proofing is required — the entity may self-assert attributes. Authentication is typically based on a single factor such as a password or PIN. This level is suitable for low-risk applications where the consequences of authentication error are negligible, such as accessing public information or maintaining a forum profile. The standard notes that while LoA 1 is appropriate for low-risk scenarios, organizations should clearly communicate the limited assurance provided to users and other relying parties.

Level 3 and Level 4: High Assurance Scenarios

For applications requiring high assurance, LoA 3 mandates multi-factor authentication using at least two of the three authentication factor categories: knowledge (something you know), possession (something you have), and inherence (something you are). The identity proofing process at LoA 3 requires either in-person verification or remote verification with biometric matching against a government-issued credential. At LoA 4, the highest level, all authentication factors must be cryptographically bound to the entity’s identity, typically through hardware cryptographic modules that have been validated against recognized security standards such as FIPS 140-2 Level 3 or Common Criteria EAL 4+.

The standard places particular emphasis on credential management security at higher assurance levels. At LoA 3 and above, credentials must be issued through a secure registration process that verifies the applicant’s identity in person or through an equivalent trusted process. Credential activation requires out-of-band verification, and credential revocation must be effective within strict time limits — typically within 24 hours for LoA 3 and within 4 hours for LoA 4. The standard also mandates comprehensive audit logging for all credential management operations, with logs retained for a minimum period specified in the organization’s security policy.

Practical Implementation Considerations

Implementing ISO/IEC 29115 requires organizations to conduct a risk assessment for each system or transaction type, identifying the consequences of authentication failures. The standard provides detailed guidance on mapping risk levels to assurance levels, considering factors such as the value of assets being protected, the potential for fraud, privacy implications, and regulatory requirements. The risk assessment methodology is based on a systematic evaluation of the likelihood and impact of authentication errors, including both false acceptance (allowing an unauthorized entity) and false rejection (denying a legitimate entity).

A critical implementation consideration is credential lifecycle management. The standard specifies requirements for credential issuance, activation, suspension, revocation, and reissuance. For example, at LoA 2 and above, credentials must have defined expiration periods, and mechanisms must exist for users to securely report lost or compromised credentials. At LoA 3 and above, credential revocation must take effect within strict time limits, and audit logs must be maintained for all credential management operations. The standard also addresses the increasingly important area of credential recovery — how users can securely regain access when their primary authentication factor is lost or unavailable.

Frequently Asked Questions