NIST 800-63B-4 restricted-authenticator file

Checklist items

1. Offer at least one alternative that isn’t restricted, for every flow that accepts SMS or voice codes.
2. Publish plain-language wording that tells users the risks of the restricted option; record where it appears.
3. Write and sign a dated risk assessment for continuing to allow each restricted authenticator.
4. Keep a migration plan with owners and milestones in case the authenticator is removed.
5. Check recovery and fallback paths for restricted authenticators that are easy to miss.
6. Set a review date for the whole file.

Ticks stay in your browser only and are not saved.

Print this checklist Clear ticks