IA-11 Re-authentication
NIST SP 800-53 (controls) 5.1.1+u4
All changes in this version
All changes in this version
Title
Re-authentication
Control
Require users to re-authenticate when [Assignment: circumstances or situations].
Discussion
In addition to the re-authentication requirements associated with device locks, organizations may require re-authentication of individuals in certain situations, including when roles, authenticators or credentials change, when security categories of systems change, when the execution of privileged functions occurs, after a fixed time period, or periodically.
Parameters
ia-11_odp: circumstances or situations
Related controls
ac-11, ac-3, ia-2, ia-3, ia-4, ia-8
Assessment objective
IA-11 users are required to re-authenticate when [Assignment: circumstances or situations].
STIG rules that implement this control 35
Apple macOS 15 (Sequoia) V1R8
- APPL-15-004022 CAT II The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.
- APPL-15-004060 CAT II The macOS system must configure sudoers timestamp type.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-004022 CAT II The macOS system must require users to reauthenticate for privilege escalation when using the "sudo" command.
- APPL-26-004060 CAT II The macOS system must configure sudoers timestamp type.
Application Security and Development V6R5
- APSC-DV-001520 CAT II The application must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.
- APSC-DV-001530 CAT II The application must require devices to reauthenticate when organization-defined circumstances or situations requiring reauthentication.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-432010 CAT II Ubuntu 22.04 LTS must require users to reauthenticate for privilege escalation or when changing roles.
- UBTU-22-432011 CAT II Ubuntu 22.04 LTS must require users to provide a password for privilege escalation.
- UBTU-22-654224 CAT II The operating system must restrict privilege elevation to authorized personnel.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-300019 CAT II Ubuntu 24.04 LTS must restrict privilege elevation to authorized personnel.
Microsoft Windows 11 V2R11
- WN11-CC-000145 CAT II Users must be prompted for a password on resume from sleep (on battery).
- WN11-CC-000150 CAT II The user must be prompted for a password on resume from sleep (plugged in).
- WN11-CC-000270 CAT II Passwords must not be saved in the Remote Desktop Client.
- WN11-CC-000280 CAT II Remote Desktop Services must always prompt a client for passwords upon connection.
- WN11-CC-000355 CAT II The Windows Remote Management (WinRM) service must not store RunAs credentials.
- WN11-SO-000245 CAT II User Account Control approval mode for the built-in Administrator must be enabled.
- WN11-SO-000255 CAT II User Account Control must automatically deny elevation requests for standard users.
- WN11-SO-000270 CAT II User Account Control must run all administrators in Admin Approval Mode, enabling UAC.
Microsoft Windows Server 2022 V2R11
- WN22-CC-000340 CAT II Windows Server 2022 must not save passwords in the Remote Desktop Client.
- WN22-CC-000360 CAT II Windows Server 2022 Remote Desktop Services must always prompt a client for passwords upon connection.
- WN22-CC-000520 CAT II Windows Server 2022 Windows Remote Management (WinRM) service must not store RunAs credentials.
- WN22-SO-000380 CAT II Windows Server 2022 User Account Control (UAC) approval mode for the built-in Administrator must be enabled.
- WN22-SO-000410 CAT II Windows Server 2022 User Account Control (UAC) must automatically deny standard user requests for elevation.
- WN22-SO-000440 CAT II Windows Server 2022 User Account Control (UAC) must run all administrators in Admin Approval Mode, enabling UAC.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-600500 CAT II RHEL 10 must restrict the use of the "su" command.
- RHEL-10-600510 CAT II RHEL 10 must be configured to not bypass password requirements for privilege escalation.
- RHEL-10-600530 CAT II RHEL 10 must require users to reauthenticate for privilege escalation.
- RHEL-10-600540 CAT II RHEL 10 must require reauthentication when using the "sudo" command.
- RHEL-10-600550 CAT II RHEL 10 must use the invoking user's password for privilege escalation when using "sudo".
- RHEL-10-600560 CAT I RHEL 10 must require users to provide a password for privilege escalation.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-432015 CAT II RHEL 9 must require reauthentication when using the "sudo" command.
- RHEL-09-432025 CAT II RHEL 9 must require users to reauthenticate for privilege escalation.
- RHEL-09-432035 CAT II RHEL 9 must restrict the use of the "su" command.
- RHEL-09-611085 CAT II RHEL 9 must require users to provide a password for privilege escalation.
- RHEL-09-611145 CAT II RHEL 9 must not be configured to bypass password requirements for privilege escalation.