साइबर सुरक्षा GRC 12 आइटम
Passwordless / FIDO2 Rollout Review
यह चेकलिस्ट अंग्रेज़ी में है।
Reviews a passwordless authentication rollout using FIDO2/passkeys, covering strategy, enrollment, phishing resistance, recovery, and legacy path closure.
FIDO2NIST 800-63BNIST 800-53
मुफ़्त PDF या Word · डाउनलोड करने के लिए अपना ईमेल दर्ज करें।
Strategy & Standards
- Are FIDO2/WebAuthn authenticators (security keys or platform passkeys) the target method? *
- Is the target authentication assurance level (AAL2/AAL3) defined per NIST 800-63B? *
- Are high-privilege users prioritized for phishing-resistant authenticators? *
Enrollment & Provisioning
- Is identity verified before enrolling a passwordless credential? *
- Is at least one backup authenticator registered per user to prevent lockout? *
- Are authenticator attestation and key requirements enforced for high-assurance roles?
Phishing Resistance
- Is the method verified as phishing-resistant (origin-bound, no shared secret)? *
- Are weaker fallback methods (SMS OTP, push) disabled or restricted for protected apps? *
- Is Conditional Access configured to require phishing-resistant auth for sensitive resources?
Recovery & Migration
- Is a secure, phishing-resistant account recovery process defined for lost authenticators? *
- Are legacy password and MFA fallback paths closed once users are migrated? *
- Are authentication events monitored to confirm adoption and detect fallback abuse?
पूरी Passwordless / FIDO2 Rollout Review चेकलिस्ट डाउनलोड करें
इसे साफ़-सुथरे, प्रिंट करने योग्य PDF या संपादन योग्य Word दस्तावेज़ के रूप में मुफ़्त पाएँ।