Risk-Based Authentication
What is Risk-Based Authentication?
An adaptive authentication approach that adjusts security requirements based on the assessed risk level of a login attempt, considering factors like location and device.
Terms that appear alongside risk-based authentication
Each of these is named in at least one of the same controls as risk-based authentication. The number is how many controls name both.
- authentication 9 shared controls
- access control 4 shared controls
- oauth 3 shared controls
- multi factor authentication 3 shared controls
- saml 3 shared controls
- nist 3 shared controls
- digital identity 2 shared controls
- zero trust 2 shared controls
Frameworks that govern risk-based authentication
What the standards actually require on risk-based authentication
Requirements naming risk-based authentication across 6 standards, quoted from the control text.
Per PSD2 RTS Articles 10-18: SCA exemptions. Requirements include (a) implement Low-Value Exemption for amounts up to EUR 30 cumulative EUR 100 + (b) implement Trusted Beneficiary Exemption for whitelisted payees + (c) implement Recurring Transaction Exemption...
PSDTWO-2 · SCA Exemptions and Risk-Based Authentication →The requestor may tell the ACS how the cardholder authenticated to it, as a list of objects: the method (01 guest checkout, 02 the requestor's own credentials, 03 federated ID, 04 issuer credentials, 05 third-party authentication, 06 FIDO authenticator, 07 FID...
emv-3-d-secure-3ds-payment-authentication-protocol::V.7 · V.7 3DS Requestor authentication information and delegated authentication data →ISMAP Identity and Access Management requires comprehensive IAM controls covering customer + CSP + administrative + service-to-service identities.
ISMAP-Identity-Access-MFA-Privileged-Federation-SSO-API-Tokens-CloudIAM-PIV-PASETO · ISMAP Identity and Access Management - Cloud IAM + Multi-Factor Authentication + Privileged Access + Federation/SSO + API Security + Access Tokens + My Number Card Integration + Government IAM →Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication confirms that each party to a communication (for example a person, device, service or application) really is who it claims to be, and gives assurance that no party is impersonating anothe...
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →Set and regularly review policies and rules for authentication and access rights: least privilege with segregation of duties; account lifecycle management with periodic inventories and review of operation histories, preventing misuse by unauthorised persons;
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.3.1-B · 2.3.1 Authentication and access management: basic actions →Implement Section 5.1-5.2 authentication and access control including: strong authentication per NIST SP 800-63 (AAL2 minimum for sensitive systems + MFA where appropriate + risk-based authentication) + identity management + role-based access control (RBAC) pe...
NISTSP123-3 · Authentication, Access Control, and Account Management →Questions people ask about risk-based authentication
What is Risk-Based Authentication?
Why is Risk-Based Authentication important for compliance?
Which compliance frameworks address Risk-Based Authentication?
Where can I learn more about Risk-Based Authentication?
See how Risk-Based Authentication applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.