Security levels explained
The two ideas of level you meet in a TDACorp account, the checkup words Strong, Fair and Needs attention, and the assurance level of a sign-in, and what each means for you.
On this page
The word level shows up in two different places, and they mean different things. One describes how well your account is set up. The other describes how strongly a particular sign-in proved who you are. This page explains both in plain terms.
The checkup score#
The Security area has a Checkup tab, and the Overview shows a Security posture panel and a Security score. The score is out of 100 and carries one of three words.
| Word | What it says about your account |
|---|---|
| Strong | The highest band of score. |
| Fair | The middle band. |
| Needs attention | The lowest band. The page lists what to do first. |
Individual checks use a second set of words: Good, Needs attention and At risk. A check is good or it is not: it earns all its points or none, so you can always see why you lost any. The page says it is a guide, and that a score of 100 does not mean you cannot be phished.
What the checkup counts#
The checkup counts only things you can change on this account. It does not look at what you do in apps. There are six checks.
| Check | Good when |
|---|---|
| Passkey | You have at least one passkey. This is worth the most. |
| A way back in | You have a second passkey, or unused recovery codes. |
| Password | The password you set was not found in a known data breach, or you have no password. It is not marked good if the password was never checked. |
| Recovery codes | You hold a few unused recovery codes. |
| Sessions | No signed-in session has gone unused for a month. |
| Second email | A second verified email address is on the account. |
A missing passkey on an account that has neither a password nor an authenticator app is rated At risk rather than Needs attention. A password found in a breach is also At risk.
Each unfinished check has an Open button that leads to the page that fixes it, and the page orders them under Do these in this order with the points each would add. It says Nothing to do right now when every check is good. Details of each step are in Your first sign-in and the setup checklist.
The assurance level of a sign-in#
Separately from the checkup, each sign-in has an assurance level, a number from 1 to 3 that says how strongly it proved who you are. The platform follows the NIST SP 800-63B vocabulary, called AAL. A higher number means a stronger proof.
| Level | What it generally means | Examples on a TDACorp account |
|---|---|---|
| 1 | A single proof. | A password on its own. An emailed sign-in link. A sign-in through a linked account, unless the provider reports a second factor. The emailed code that replaces a lost passkey (Email me a code instead). |
| 2 | Two kinds of proof. | A passkey, because identity requires your face, fingerprint or screen lock on top of the device itself. A password with an authenticator app. |
| 3 | A hardware-bound proof whose make has been verified. | Planned. Identity does not verify the maker of a passkey yet, so no passkey reaches level 3 today. |
The extra steps you can turn on, Use my password and Email me a code, are not two-factor. They add a check, but they do not raise the level. Neither does Email me a code instead: a session opened with it stays at level 1, so an application that needs level 2 still asks for a passkey.
The lost-passkey sign-in. If your passkey is your only second step and you lost it, the sign-in page can offer Email me a code instead after your password. That session is level 1 and never counts as level 2, however recently you used it. Some apps will still ask for your passkey. The platform always sends a new-sign-in alert for it, does not offer to remember the browser, and tells your other verified addresses when the code is sent. Until you confirm with a passkey or an authenticator code, that session cannot sign your other sessions out, leave an organization, accept or decline an invitation, add an email address, cancel a recovery, revoke an application's access or mark security events read.
The password-only sign-in. A correct password always signs you in. When the platform sees something unusual (a new browser or place), an account with a passkey or an authenticator app is asked for it, and can instead choose Continue with my password only (limited session). That session is level 1, the new-sign-in alert is always sent, the browser is not remembered, and the actions that need a second factor show Confirm it is you until you confirm with a passkey or an authenticator code.
You do not set a level. It follows from how you sign in. The Devices list also has an Assurance column (One factor, Two factors or Strongest). The Sign-in method column names what each session used, for example Passkey, Password, Authenticator app, Email link, Linked account or Recovery code.
Why it matters to you#
- Some applications and organizations ask for a minimum level. If you sign in with a method that is too weak, the page can say That sign-in method is not strong enough for this application.
- A sensitive action asks for a fresh proof. The message Confirm it is you with a stronger sign-in method to continue. means the platform needs a passkey or an authenticator code now, whatever you used to sign in. The Confirm it is you prompt gives it. A second factor used in the last 30 minutes counts.
- The same session can rise. Confirming with a passkey raises the strength of the current session for a while, without signing you in again.
Which to look at#
Use the checkup to improve your account over time. Use the assurance level to understand why one sign-in is enough for one task and not another. A Strong checkup score does not mean every sign-in is level 2. A password-only sign-in is level 1 whatever your score says.
The limits of both#
Neither level says your account is safe. A phisher can capture a password and, in the moment, an authenticator code, but cannot use a passkey. A level is a statement about the sign-in method, not about the device it ran on. For more on what is claimed and what is not, see Security practices.