Factory Reset Protection is a device security control that reduces misuse after a mobile device is wiped. After a factory reset, the device may require the previously synced account or equivalent proof before setup continues. In identity security, FRP helps prevent unauthorized reuse of lost or stolen endpoints and supports device trust.
How Factory Reset Protection Works
factory reset Protection is a post-wipe access control that links a reset device to a previously trusted account or equivalent proof of ownership. Its purpose is to stop a stolen or found phone from being turned into an immediately usable device after a factory reset.
The control is most visible during initial setup after the wipe. If the device still recognises that it belongs to a prior owner, setup is paused until the correct account credentials, recovery path, or manufacturer-approved proof is provided. That makes the reset less useful to a thief while still allowing a legitimate owner to reclaim the device.
Why FRP Matters for Device Trust
FRP strengthens the trust boundary around mobile endpoints. A factory reset normally removes local user data and settings, but it does not necessarily establish a new legitimate owner. FRP closes that gap by making ownership continuity part of the device re-enrolment process.
That matters because mobile devices often carry email, messaging, authentication apps, work profile data, and cached enterprise access. If a reset device could be reactivated freely, an attacker could repurpose hardware that still has value as a computing platform, a communication device, or a foothold into connected services. NIST Cybersecurity Framework 2.0 is useful here as a broad lens for protecting devices, identities, and recovery processes across the asset lifecycle.
FRP in the Mobile Identity Lifecycle
FRP is not just about the device chassis, it is about the identity relationship attached to that device. The control depends on the idea that a trusted account, device registration, or similar proof can be used to distinguish the legitimate owner from someone trying to reuse recovered hardware.
That is why FRP sits at the intersection of endpoint security and identity assurance. It does not replace authentication for the device itself or for downstream services, but it can prevent an attacker from using a wiped handset as a clean starting point for account recovery abuse, phishing, or device-based access attempts. NIST SP 800-63 Digital Identity Guidelines is a useful reference for understanding how proofing and authenticators support trustworthy re-enrolment.
What FRP Does and Does Not Protect
FRP helps prevent casual reuse after wipe, but it is not a complete anti-theft control. It does not physically recover the device, and it does not guarantee that all data, tokens, or sessions are gone if the device was compromised before the reset. It also depends on the account recovery path remaining secure and available to the real owner.
As a result, organisations should treat FRP as one layer in a larger endpoint and identity protection model. If the connected cloud account is weakly protected, if recovery channels are exposed, or if support staff can be socially engineered, the protection weakens even though the device-level control is still present. NIST SP 800-53 Rev 5 Security and Privacy Controls provides relevant control families for access control, authentication, configuration management, and auditability around these dependencies.
Risk and Threat Considerations
FRP is valuable because it raises the cost of device reuse after theft, but its security depends on the strength of the linked account and the recovery process. If that account is compromised, weakly recovered, or bypassed through support abuse, the protection can be defeated even when the device itself was wiped correctly.
Failure mechanism: An attacker resets or acquires the device, then uses stolen credentials, weak recovery, or support-channel manipulation to satisfy the post-reset ownership check.
Impact: The device can be repurposed, resold, or used to pursue further account abuse, reducing the value of the wipe and increasing the chance of downstream identity and access compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Managed Access Control | FRP enforces post-reset access decisions before device reuse. |
| Recommendation — Enforce managed access checks before a reset device can be re-enrolled. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | FRP depends on secure account proof and recovery material. |
| IA-2 — Identification and Authentication (Organizational Users) | FRP relies on the legitimate user's identity proof during setup. | |
| Recommendation — Protect recovery and authenticator lifecycle so reset checks remain trustworthy. Require strong user authentication before allowing device reactivation. | ||
| CIS Controls v8 | CIS-5 — Account Management | FRP depends on trustworthy account ownership and recovery paths. |
| Recommendation — Govern account ownership and recovery so reset devices cannot be misused. | ||
Practitioner Guidance
Why practitioners should care: FRP should be treated as part of mobile fleet control, not as a consumer-only feature. It matters most where lost-device handling, user enrolment, and account recovery all influence whether a reset endpoint can safely return to service.
What to watch for: Pay attention to devices leaving inventory without a clear ownership trail, repeated recovery requests, and support workflows that can override ownership checks too easily. Those are often the points where the protection fails in practice.
Practitioner takeaway: FRP works best when device registration, account recovery, and endpoint deprovisioning are designed as one control chain rather than separate processes.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 24, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org