{"id":"10c7de42-679f-482a-bc48-1e5cb205d57a","task":"Audit an existing identity proofing integration and replace KBA with compliant NIST 800-63A-4 alternatives","domain":"pages.nist.gov","steps":["Inventory all identity proofing touchpoints in the application: locate any step that uses static or dynamic KBA questions (mother's maiden name, street address history, previous vehicle) as a verification or authentication factor.","Classify each KBA use: authentication-step KBA is entirely prohibited under NIST 800-63B-4; proofing-step KBA is only permitted as a single Fair-level evidence supplement for identity resolution, not as the primary verification binding.","Replace authentication-step KBA with a FIDO2 passkey, OTP (TOTP or SMS), or push authenticator to achieve AAL2; document the authenticator type and assurance level in the system security plan.","For remote IAL2 proofing, replace KBA-based identity binding with biometric comparison: capture a selfie, run a face match against the document portrait, and run liveness/PAD detection; this combination satisfies the binding requirement in 800-63A-4.","Update the Digital Identity Acceptance Statement or equivalent documentation to reflect the new xAL configuration and the evidence strength for each proofing pathway.","Conduct a regression test with edge-case users (hyphenated names, non-Latin characters, thin-file individuals) to confirm the replacement proofing path does not introduce unacceptable failure rates."],"gotchas":["Dynamic KBA sourced from credit bureau records was widely used at IAL2 before 800-63-3 and is now prohibited for binding at IAL2 under 800-63A-4; services that have not updated since 2017 may still have this pattern in production.","Replacing KBA can increase friction for thin-file populations (recent immigrants, young adults) who lack sufficient document-to-database match signals; design a supervised proofing fallback for these cases.","SP 800-63-4 uses the term knowledge-based verification (KBV) for proofing contexts and distinguishes it from authentication-context KBA; both are heavily restricted but the specific permitted uses differ — read both 800-63A-4 and 800-63B-4 sections."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.366Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/10c7de42-679f-482a-bc48-1e5cb205d57a"}