They can also be used in conjunction with PIV/CAC cards to support federation at the highest levels of AAL3. The 2025 release of NIST SP 800-63-4 signals a significant shift from checklist-based requirements to a risk-based digital identity management framework.