organization-defined circumstances or situations requiring re-authentication
163684·updated Oct 5, 2026A policy parameter placeholder used in risk-based access-control frameworks — specifically the customizable slot within a re-authentication control statement that an organization fills with its own enumerated list of trigger conditions. Organizations are expected to specify events or states that invalidate the assurance level of an existing session, such as role changes, credential updates, escalation to privileged functions, elapsed time thresholds, or changes in system security category. In practice the expression functions as an assignment variable: it signals that the standard body intentionally defers the concrete trigger list to the implementing organization rather than prescribing a universal set, so that the control scales across different risk environments and mission contexts.
Source
Re-authenticate users when [ Assignment: organization-defined circumstances or situations requiring re-authentication ].the sentence this term was read in
generalized from a web lookup of the quoted expression, with 1 reviewed place(s) it is used as the term Verdict: compositional.
- IA-11: Re-Authentication
- 03.05.01: User Identification and Authentication
- Identification and authentication - Canadian Centre for Cyber Security
- PR.AA-03: Users, services, and hardware are authenticated - CSF Tools
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A policy parameter placeholder used in risk-based access-control frameworks — specifically the customizable slot within a re-authentication control statement that an organization fills with its own enumerated list of trigger conditions. Organizations are expected to specify events or states that invalidate the assurance level of an existing session, such as role changes, credential updates, escalation to privileged functions, elapsed time thresholds, or changes in system security category. In practice the expression functions as an assignment variable: it signals that the standard body intentionally defers the concrete trigger list to the implementing organization rather than prescribing a universal set, so that the control scales across different risk environments and mission contexts.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- organization-defined circumstances or situations requiring re-authentications
- possessive
- organization-defined circumstances or situations requiring re-authentication's
- pluralpossessive
- organization-defined circumstances or situations requiring re-authentications'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in NIST SP 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A policy parameter placeholder used in risk-based access-control frameworks — specifically the customizable slot within a re-authentication control statement that an organization fills with its own enumerated list of trigger conditions. Organizations are expected to specify events or states that invalidate the assurance level of an existing session, such as role changes, credential updates, escalation to privileged functions, elapsed time thresholds, or changes in system security category. In practice the expression functions as an assignment variable: it signals that the standard body intentionally defers the concrete trigger list to the implementing organization rather than prescribing a universal set, so that the control scales across different risk environments and mission contexts.Drafted by the propose-term web lookup (PD-018); a curator confirms or replaces it.