# risc

Source: https://startwithidentity.com/glossary/risc/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

RISC (Risk Incident Sharing and Coordination) is an OpenID Foundation specification, the [OpenID RISC Profile Specification 1.0](https://openid.net/specs/openid-risc-1_0-final.html), that defines account-level security event types, such as credential compromise, account disabled, identifier recycled, and sessions revoked, delivered as Security Event Tokens over the Shared Signals Framework. It was approved as an OpenID Final Specification together with SSF and CAEP in September 2025.

Where CAEP is about sessions changing state, RISC is about accounts at risk. The classic use case is cross-provider: when the email provider that holds a user's recovery address detects a takeover, it can tell every relying party that uses that address to log the user in, so they stop trusting password resets sent there. The "identifier recycled" event addresses a quieter problem, an email address or phone number reassigned to a new person who then inherits the old owner's accounts. Google sends RISC events to apps that use Sign in with Google through its [Cross-Account Protection](https://developers.google.com/identity/protocols/risc) program; the receiving side is where adoption lags, and an event nobody acts on changes nothing.

See also: [Shared Signals Framework](https://startwithidentity.com/glossary/shared-signals-framework/), [CAEP](https://startwithidentity.com/glossary/caep/), [Security Event Token](https://startwithidentity.com/glossary/security-event-token/), [account takeover](https://startwithidentity.com/glossary/account-takeover/), [account recovery](https://startwithidentity.com/glossary/account-recovery/), [ITDR](https://startwithidentity.com/glossary/itdr/)