ComplianceNIST 800-53 control

NIST-IA-11 Re-authentication

Official page ↗

Framework: NIST SP 800-53 rev5 (5.2.0)
Family: IA Identification and Authentication
Control: IA-11
ATT&CK techniques mitigated: 7

Control statement

Require users to re-authenticate when [Assignment: circumstances or situations].

Discussion

In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.

ATT&CK mappings (CTID)

• T1110 Brute Force • T1110.001 Password Guessing • T1110.002 Password Cracking • T1110.003 Password Spraying • T1110.004 Credential Stuffing • T1556.006 Multi-Factor Authentication • T1556.007 Hybrid Identity

Mitigates · MITRE ATT&CK (7)

T1556.007 Hybrid Identity sub-technique
T1556.006 Multi-Factor Authentication sub-technique
T1110.001 Password Guessing sub-technique
T1110.002 Password Cracking sub-technique
T1110.003 Password Spraying sub-technique
T1110.004 Credential Stuffing sub-technique
T1110 Brute Force technique

Related control · Compliance (6)

NIST-AC-11 Device Lock NIST 800-53 control
NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
NIST-IA-3 Device Identification and Authentication NIST 800-53 control
NIST-IA-4 Identifier Management NIST 800-53 control
NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control

Referenced by Compliance · has member (1)

NIST-IA Identification and Authentication NIST 800-53 family

Referenced by Compliance · related control (5)

NIST-AC-11 Device Lock NIST 800-53 control
NIST-AC-3 Access Enforcement NIST 800-53 control
NIST-IA-2(13) Out-of-band Authentication NIST 800-53 enhancement
NIST-IA-3 Device Identification and Authentication NIST 800-53 control
NIST-IA-8 Identification and Authentication (Non-organizational Users) NIST 800-53 control