# What does “restricted authenticator” mean in NIST SP 800-63B-4?

> **Short answer:** A restricted authenticator is one NIST still permits but considers riskier, such as SMS or voice one-time passcodes. An organization that uses one takes on four obligations: offer a non-restricted alternative, tell users the risks, assess the risk of continuing, and keep a migration plan in case a future revision removes it.

- URL: https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## The four obligations

An organization that keeps offering SMS or voice codes takes on four obligations under SP 800-63B-4:[^1]

1. **Offer an alternative** that isn’t restricted, so no user is left with SMS as their only option.
2. **Tell users the risks** of the restricted option in plain language.
3. **Assess the risk** to users and to the organization of continuing to allow it.
4. **Keep a migration plan** in case the authenticator is removed in a future revision.

## How to evidence each one

| Obligation | Evidence an auditor can check |
|---|---|
| Offer an alternative | Enrollment screens that show a non-restricted option; the share of users enrolled in it |
| Tell users the risks | The user-facing copy and where in the flow it appears |
| Assess the risk | A dated document with an owner and a review cadence |
| Keep a migration plan | Retirement dates per flow and the metric that triggers each one |
Table: Cleartext’s suggested evidence for each obligation. The obligations are NIST’s; the evidence column is not NIST text.

## Why NIST chose conditions over a ban

SMS reaches almost every phone, which is why it became the default second factor. Removing it outright would strand users who have nothing else. The restricted category keeps that reach while making the organization own the risk and the exit plan.

## What this means for you

### Banks & credit unions

Treat the four obligations as audit evidence, not intentions. Each one should map to an artifact an examiner can see: an enrollment screen, a piece of user-facing copy, a dated document and a roadmap.

### Fintechs & payment firms

The cheapest way to meet the conditions is at design time: build enrollment so users choose between SMS and a passkey, with the risk notice shown next to SMS.

### Developers & identity teams

Store the authenticator type on every credential and log which type completed each sign-in. You can’t write a migration plan without knowing how many users depend on the restricted method.

## Follow-up questions

**Is the restricted category new in Revision 4?**

No. NIST introduced it in Revision 3 of SP 800-63B in 2017. Revision 4 keeps SMS and voice codes in it.


## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html

## Related questions

- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)
- [Do US banks have to follow NIST SP 800-63?](https://glide-cleartext.pages.dev/q/do-us-banks-have-to-follow-nist-800-63/)
- [Has any US regulator banned SMS OTP?](https://glide-cleartext.pages.dev/q/has-any-us-regulator-banned-sms-otp/)

## Cite

Cleartext. “What does “restricted authenticator” mean in NIST SP 800-63B-4?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-does-restricted-authenticator-mean-in-nist-800-63b/

## Changelog

- 2026-09-24: First published.