Step-Up Authentication

Overview

Step-Up Authentication is an authentication process that requires stronger or additional proof when a user attempts a higher-risk action or when contextual signals exceed a defined risk threshold. It supplements an existing session rather than requiring the strongest authentication for every low-risk interaction. It should be interpreted alongside Adaptive Authentication, which may affect the same workflow without representing the same control, event, or risk.

Poor implementation can allow session hijacking, weak recovery channels, predictable challenges, excessive user friction, or bypass through unprotected alternative workflows.

Organizations should define protected actions, use phishing-resistant authenticators, bind the challenge to the transaction, limit fallback methods, evaluate device and session context, and log outcomes.

Retain triggering signals, action details, session and device identifiers, authenticator used, challenge result, fallback path, decision, timestamp, and subsequent transaction result.

For Step-Up Authentication, the trust decision should establish the requirement for stronger or additional proof when a user attempts a higher-risk action or when contextual signals exceed a defined risk threshold and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for identity proof and credential state, rather than checking only a successful request. Logs concerning the Step-Up identity check and identity proof and credential state should support investigation without exposing reusable secrets or unnecessary personal data.

Review of Step-Up Authentication should compare permitted and rejected actions related to identity proof and credential state, confirm that recovery cannot bypass the primary safeguard, and remove obsolete access promptly.