In case you are wondering why I’m addressing this post to Deborah rather than messaging her directly, I can’t.
Deborah, you see, is a fictional character.
She appeared in last night’s post “For Biometric Firms Seeking a Consulting Product Marketing Writer With Extensive Biometric Expertise.”
In the fictional story…well, the semi-fictional story…Deborah was dreading her upcoming meeting with a new outside consultant.
“Remember the last consultant we brought in? We spent an hour explaining the difference between a bifurcation and a ridge ending. And the writer was completely confused by the difference between FRTE and FATE.”
You see, Deborah had spent eight years in the biometric industry and knew it backwards and forwards…or so she thought.
Until she learned that the consultant had been in the industry since 1994.
My story touched upon a number of biometric topics, all of which I have written about. But this one time I failed to load the story with a ton of outbound links to previous Bredemarket posts. I just wanted to tell the story.
For example, the consultant asks Deborah this question at one point:
“Which reminds me: are you going for PAD Level 3 or IAL 3? Both are becoming more important, and you don’t want to get left behind.”
Identity Assurance Levels
I’m not going to explain the PAD acronym right now, but IAL stands for Identity Assurance Level, and IAL 3 is the level to which many identity companies aspire. The text below is repurposed from my August 2025 post “Identity Assurance Level 3 (IAL3): When Identity Assurance Level 2 (IAL2) Isn’t Good Enough.”
First, let’s review the three identity assurance levels.
From https://pages.nist.gov/800-63-3/sp800-63a.html#sec2.
I really need to update this to the newer NIST 800-63-4.
But anyway, the big difference between IAL2 and IAL3 is that IAL2 allows “either remote or physically-present identity proofing,” while IAL3 requires “[p]hysical presence” for identity proofing. However, the proofing agent may “attend the identity proofing session via a CSP-controlled kiosk or device.” In other words, supervised enrollment.
When do you need IAL3? Mitek’s Adam Bacia clarifies:
“IAL3 is reserved for high-risk environments such as sensitive government services.”
For more details on IAL 3 and who had achieved it (as of August 2025), visit my original post.
Bredemarket 