{"data":{"id":"IA-11","name":"Re-authentication","family":"IA","family_name":"Identification and Authentication","withdrawn":false,"description":"Require users to re-authenticate when [Assignment: organization-defined circumstances or situations requiring re-authentication].","supplemental_guidance":"In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.","enhancements":[],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"IA-11","name":"Re-authentication","description":"Require users to re-authenticate when [Assignment: organization-defined circumstances or situations requiring re-authentication].","discussion":"In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.","related_controls":["AC-03","AC-11","IA-02","IA-03","IA-04","IA-08"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":false,"new_in_rev5":false,"changes_from_rev4":""}},"compliance_mappings":{"iso_27001_2022":["A.8.5"],"iso_27002_2022":["5.17","8.5"],"cobit_2019":["DSS05"],"pci_dss_v4":[],"nist_csf_2":["PR.AA-01","PR.AA-03"],"cis_controls_v8":[],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":[],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":["9"],"pra_op_resilience":[],"bsi_grundschutz":["ORP.4"],"anssi":[],"osfi_b13":[],"finma_circular":[],"gdpr":[],"dora":[],"bio2":["5.17","8.5"],"rbi_csf":["Annex1.8"],"fisc":[],"lgpd_bcb":[],"hkma_tme1":["TME1.8.3","TME1.10.4"],"mlps_2":["8.1.4.1"],"dnb_good_practice":[],"cra":["CRA.I.2d"],"swift_cscf":[],"cbb_tm":["TM-6"],"cbuae":["CR-4"],"nca_ecc":["2-2"],"qatar_nia":["AC"],"sama_csf":["3.1"],"uae_ia":["T9"],"bog_cisd":["CISD-VIII"],"bom_ctrm":["3.3"],"cbe_csf":["CTO-1"],"cbn_csf":["Part3.2"],"sa_js2":["JS2-7.1","JS2-8.1"],"bot_cyber":["Ch2.2"],"eba_ict":["3.8(b)"],"ffiec_is":["II.C.15"],"hipaa_sr":["§164.308(a)(5)(ii)(D)","§164.312(d)"],"cmmc_2":["IA"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":["CC Part 2 — FIA"],"isae_3402":[],"fca_sysc_13":[],"fda_21_cfr_11":["§11.200(a)(1)(i)","§11.200(a)(1)(ii)"],"fda_cyber":["SA-1"],"hitrust_csf":["01.c"],"iso_27799":["9.4"],"lloyds_ms":[],"naic_ds":[],"nhs_dspt":["NDG-4.3"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":["MASVS-AUTH-3"],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[{"id":"T1110","name":"Brute Force","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Mandatory re-authentication after failed attempts forces adversaries to restart brute force campaigns from scratch, significantly increasing the time and effort required for credential compromise."},{"id":"T1110.001","name":"Password Guessing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Re-authentication requirements with progressive lockout after failed attempts directly counter password guessing by limiting the number of authentication attempts within each session window."},{"id":"T1110.002","name":"Password Cracking","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Mandatory re-authentication with fresh challenge-response mechanisms prevents adversaries from replaying cracked credentials, since re-authentication requires current session context validation."},{"id":"T1110.003","name":"Password Spraying","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Re-authentication requirements with session-specific lockout counter password spraying by limiting per-session attempts, preventing adversaries from distributing guesses across accounts without triggering lockout."},{"id":"T1110.004","name":"Credential Stuffing","tactics":["credential-access"],"mapping_type":"mitigates","mapping_rationale":"Mandatory re-authentication with rate limiting on new sessions counters credential stuffing by throttling the speed at which adversaries can test harvested credential pairs across authentication endpoints."},{"id":"T1556.006","name":"Multi-Factor Authentication","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Re-authentication requirements that enforce fresh MFA challenges prevent adversaries who have compromised the MFA pipeline from maintaining persistent access through modified authentication flows."},{"id":"T1556.007","name":"Hybrid Identity","tactics":["credential-access","defense-evasion","persistence"],"mapping_type":"mitigates","mapping_rationale":"Re-authentication across hybrid identity systems forces validation against both on-premises and cloud identity providers, detecting adversaries who have compromised only one side of the hybrid identity chain."}],"metadata":{"last_reviewed":"2026-10-03","review_notes":"Generated from NIST SP 800-53 Rev 5 with compliance mappings from framework-coverage data 2026-10-03: nist_csf_2 PR.AA-01, PR.AA-03 added from NIST's CSF 2.0 to SP 800-53 Rev 5.2.0 crosswalk (OLIR entry 186), which OSA's mapping now takes as its base. 2026-10-03: baselines --- to LMH; Rev 5 baselines --- to LMH, from NIST SP 800-53B Release 5.2.0.","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-032"]}}