# IA-11 Re-authentication

NIST SP 800-53 control. Family: IA Identification and Authentication. Function: preventative. Baselines: low, moderate, high. Mapping licence: CC BY-SA 4.0.

Statement: Require users to re-authenticate when [Assignment: organization-defined circumstances or situations requiring re-authentication].
Guidance: In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.

## Patterns that use it (1)
- Important (1): SP-032 Modern Authentication

## Clauses by framework (34 frameworks)
- iso_27001_2022: A.8.5. OSA's own, not in NIST's crosswalk: A.8.5
- iso_27002_2022: 5.17, 8.5
- cobit_2019: DSS05
- nist_csf_2: PR.AA-01, PR.AA-03
- mas_trm: 9
- bsi_grundschutz: ORP.4
- bio2: 5.17, 8.5
- rbi_csf: Annex1.8
- hkma_tme1: TME1.8.3, TME1.10.4
- mlps_2: 8.1.4.1
- cra: CRA.I.2d
- cbb_tm: TM-6
- cbuae: CR-4
- nca_ecc: 2-2
- qatar_nia: AC
- sama_csf: 3.1
- uae_ia: T9
- bog_cisd: CISD-VIII
- bom_ctrm: 3.3
- cbe_csf: CTO-1
- cbn_csf: Part3.2
- sa_js2: JS2-7.1, JS2-8.1
- bot_cyber: Ch2.2
- eba_ict: 3.8(b)
- ffiec_is: II.C.15
- hipaa_sr: §164.308(a)(5)(ii)(D), §164.312(d)
- cmmc_2: IA
- common_criteria: CC Part 2 — FIA
- fda_21_cfr_11: §11.200(a)(1)(i), §11.200(a)(1)(ii)
- fda_cyber: SA-1
- hitrust_csf: 01.c
- iso_27799: 9.4
- nhs_dspt: NDG-4.3
- owasp_masvs_v2: MASVS-AUTH-3
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/IA-11
- Clauses only: /api/v1/controls/IA-11?fields=mappings
- Page for people: /controls/ia-11/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.