AAL (Authenticator Assurance Level)
Also known as: Authenticator Assurance Level · AAL1 AAL2 AAL3
Definition
AAL (Authenticator Assurance Level) is the NIST 800-63B classification of authentication strength — AAL1 (single factor), AAL2 (two factors, resistant to replay), AAL3 (hardware crypto authenticator, phishing-resistant).
AAL is the canonical NIST framework for evaluating authentication strength. AAL1 is single-factor (password alone). AAL2 requires two factors and protection against MitM relay (push with number matching meets AAL2). AAL3 requires hardware-based crypto authenticator + phishing resistance — FIDO2 / PIV cards qualify.
Federal programs and many private-sector privileged-access policies anchor to AAL3 for sensitive surfaces. NIST 800-63B is the source document; the assurance levels combine with IAL (Identity Assurance Level) and FAL (Federation Assurance Level) to give a holistic identity-proofing + authentication + federation classification.