IA-10 Adaptive Authentication requires individuals accessing the system to use specific supplemental authentication techniques under specific circumstances. Both the techniques and the circumstances are values your organization chooses. The idea is simple: a stolen credential should not be enough when the session looks wrong.
800-53 binds US federal systems and contract holders. If you are not in that group, use it as a reference when a customer asks how you handle risky sign ins.
What it means in practice
NIST notes that adversaries may compromise individual authentication mechanisms and impersonate legitimate users. Suspicious behavior may include accessing information the person does not normally touch for their role, or pulling far more data than usual. In response, you add a step: a second factor, a stronger factor, a manager approval or a block.
Most identity providers already support this under names like risk based or conditional access. Triggers include a new device, an impossible travel pattern, a sensitive application, or a high risk score.
Evidence to collect
- The written list of triggers and the extra authentication each one requires.
- Screenshots or exports of the conditional access or risk policies in your identity provider.
- Log samples showing a challenge was raised and its outcome.
- Review records for how you tuned the rules.
Common gaps
Policies set to report only mode and never enforced. Exemptions for executives that nobody reviews. Triggers that exist for sign in but not for later actions such as bulk export.
How to implement it
Pick three or four triggers you can defend. Enforce them for privileged roles first. Review the exemption list monthly. Keep a short note on why each trigger was chosen.
Quick check
Who decides the techniques and circumstances in IA-10?
Your organization does. The control leaves both values open, so your documented choices become the thing an auditor tests.
