Does your organization implement periodic reauthentication requirements for users, services, and hardware based on risk levels, particularly in zero trust architectures?

Periodic reauthentication helps verify that the entity accessing resources is still the authorized entity, reducing the risk of compromised credentials or unauthorized access. This control is especially important in zero trust architectures where continuous verification is a core principle.

Examples include requiring users to re-enter credentials after a period of inactivity, services to refresh authentication tokens regularly, and hardware devices to periodically validate their identity through certificates or other mechanisms.

Evidence of fulfillment could include a documented reauthentication policy that defines different reauthentication frequencies based on risk levels, system configuration screenshots showing timeout settings, authentication logs demonstrating periodic reauthentication events, or identity provider settings that enforce token expiration and renewal requirements.