| Without re-authentication, users may access resources or perform tasks for which they do not have authorization.
When devices provide the capability to change security roles, it is critical the user re-authenticate.
In addition to the re-authentication requirements associated with session locks, organizations may require re-authentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances.
(i) When authenticators change;
(ii) When roles change;
(iii) When security categories of information systems change;
(iv) When the execution of privileged functions occurs;
(v) After a fixed period of time; or
(vi) Periodically.
Within the DoD, the minimum circumstances requiring re-authentication are privilege escalation and role changes. |
