https://pages.nist.gov/800-63-3/ These latest NIST guidelines speaks about the idea of identity assurance. That’s different from identity management. It’s not about “Can a user meet a challenge?” so much as about “Can a user prove they are who they say they are?”