Skip to content

Step-Up Authentication

What is Step-Up Authentication?

An authentication approach that requires additional verification when a user attempts to access higher-risk resources or perform sensitive operations.

Information Security

Frameworks that govern step-up authentication

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on step-up authentication

Requirements naming step-up authentication across 4 standards, quoted from the control text.

EMV 3‑D Secure (3DS) - Payment Authentication Protocol1 control

In the challenge flow the ACS requires an interactive step-up authentication of the cardholder (via CReq/CRes) before returning a result, used where risk, data quality or regulatory requirements (e.g. SCA) demand stronger assurance.

EMV3DS-12 · Challenge flow →
Japan FSA Cybersecurity Guidelines for Financial Institutions1 control

Identity and Access Management (IAM) is a critical control area per FSA Cybersecurity Guidelines + intersects with FISC Security Guidelines + Japan Banking Customer Authentication Standards + APPI access control.

JP-FSA-CYB-Identity-Access-Management-Privileged-Access-MFA-Zero-Trust-Just-In-Time-Banking-Customer-Authentication · Japan FSA Cybersecurity Identity and Access Management + Privileged Access + MFA + Zero Trust + Just-In-Time + Banking Customer Authentication + Risk-Based Authentication + Out-of-Band + Biometric + FIDO2 + Internet Banking Security →
NIST SP 800-2071 control

Authentication and authorization are strict, enforced before access, and re evaluated as risk signals change. Step up authentication is applied when risk increases, and weak factors are not accepted for sensitive resources.

SP800-207-2.6 · Tenet 6: Dynamic Authentication and Authorization →
OWASP MASVS1 control

Per OWASP MASVS v2 MASVS-AUTH: secure authentication and authorization in mobile apps. Requirements include (a) implement strong server-side authentication aligned to standards (OAuth 2.0 + OIDC + FIDO2/WebAuthn + biometric where appropriate) + (b) require mul...

OWASPMASVS-3 · MASVS-AUTH: Authentication and Authorization →

Questions people ask about step-up authentication

What is Step-Up Authentication?
An authentication approach that requires additional verification when a user attempts to access higher-risk resources or perform sensitive operations.
Why is Step-Up Authentication important for compliance?
Step-Up Authentication is a key concept in Information Security. Understanding step-up authentication helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Step-Up Authentication?
Step-Up Authentication appears in the requirement text of EMV 3‑D Secure (3DS) - Payment Authentication Protocol, Japan FSA Cybersecurity Guidelines for Financial Institutions, NIST SP 800-207, OWASP MASVS. Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Step-Up Authentication?
Explore our compliance framework pages to see how step-up authentication applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Step-Up Authentication applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.