Re-authentication IA-11

Identification and Authentication · Low baseline ✗ Not implemented

Status — program-wide

What references this control

No risks name this control in their Framework field yet.

No policies reference it yet.

Link a risk or policy to this control

Attaching adds IA-11 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.

Source: NIST SP 800-53 Rev.5, Identification and Authentication family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.

Control guide — plain-English, per NIST SP 800-53

IA-11 (Re-authentication) is about making a user prove who they are again at the right moments — not only once at login. When something sensitive happens, or after a stretch of idle time, the session should ask for credentials again instead of trusting the old login forever. It is a technical Identification and Authentication control in the Low baseline that carries up into Moderate and High.

What good looks like

Decide the circumstances that should force a fresh login — for example, before a privilege change, after a set idle period, or when a role or credential changes.
Require a password again when a user escalates privilege with sudo — do not hand out blanket NOPASSWD rules.
Keep the sudo credential cache short so a walked-away terminal cannot keep running admin commands on the last login.
Time out idle sessions so an unattended shell or Secure Shell (SSH) connection closes and the next person has to authenticate.
Lock the console after inactivity so returning to the desk requires re-authentication.

Framework mapping

NIST CSF 2.0 — PR.AA-03 — Users, services, and hardware are authenticated

How to move it toward Implemented

Run visudo and set a short re-authentication window with Defaults timestamp_timeout=15 (minutes), then confirm no rule grants NOPASSWD unless it is genuinely justified.
Add an idle-shell timeout: create /etc/profile.d/tmout.sh containing readonly TMOUT=900; export TMOUT (900 seconds) so inactive shells log out on their own.
Drop idle Secure Shell (SSH) sessions: in /etc/ssh/sshd_config set ClientAliveInterval 300 and ClientAliveCountMax 0, then run sudo systemctl restart sshd.
Capture proof it works — a transcript of an idle session closing and of sudo re-prompting for a password after the timeout — saved as a dated file.
Attach that transcript as hardening evidence on the asset, naming IA-11 in the Requirement field — that moves it from ‘To assess’ toward ‘Completed’.