PR.AC-7: Risk-Based Authentication
Risk-based authentication ensures your organization applies authentication controls proportional to actual threat level—not one-size-fits-all policies. NIST CSF's PR.AC-7 requires you to match authentication strength (single-factor, multi-factor, or advanced methods) to the security and privacy risks of each transaction. This control reduces friction for low-risk activities while protecting high-value assets.
What this means
Risk-based authentication is a dynamic access control strategy that adjusts authentication requirements based on real-time risk signals. Instead of enforcing the same authentication method for every user and transaction, you calibrate controls to match organizational and individual risk profiles. This means a routine internal file access might require only password authentication, while accessing sensitive customer data or financial systems triggers multi-factor authentication. The control acknowledges that rigid, uniform authentication creates either security gaps (when standards are too weak) or user friction (when they're unnecessarily strict). By aligning authentication rigor to actual risk—considering factors like user behavior, location, device trust, and data sensitivity—you protect high-value assets while maintaining usability.
How to comply
- 1.Identify and classify your organization's assets, systems, and transactions by risk level (low, medium, high, critical)
- 2.Define authentication requirements for each risk tier (e.g., password-only for low-risk; MFA for medium/high; adaptive authentication for critical)
- 3.Document the risk factors that trigger elevated authentication (unusual location, high-value transaction, sensitive data access, privileged operations)
- 4.Implement technical controls to enforce authentication rules dynamically (conditional access policies, identity platforms with risk scoring)
- 5.Test risk-based rules regularly to ensure appropriate sensitivity—alert on anomalies without blocking legitimate users
- 6.Monitor and log all authentication events and risk-driven decisions for audit trails
- 7.Review and update authentication policies quarterly as organizational risk landscape evolves
Evidence auditors look for
- Risk classification matrix mapping transaction types and data sensitivity to required authentication methods
- Conditional access policy documentation showing authentication rules triggered by risk factors
- Identity provider logs demonstrating MFA enforcement for high-risk transactions
- Device risk assessment reports and user behavior analytics feeding authentication decisions
- Incident logs showing blocked or challenged access attempts due to elevated risk signals
- Policy review records and quarterly updates to authentication requirements
- User training materials explaining why certain transactions require additional authentication
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates risk classification and maps authentication policies to transaction types, then tracks enforcement across your identity platform—eliminating manual audits and ensuring PR.AC-7 compliance without config overhead.
See how GRCWatch handles this control automatically
Start free trial