Passkey
What is Passkey?
A passwordless authentication credential based on the FIDO2 standard that uses public key cryptography and biometrics for secure, phishing-resistant sign-in.
Terms that appear alongside passkey
Each of these is named in at least one of the same controls as passkey. The number is how many controls name both.
- authentication 6 shared controls
- policy 2 shared controls
- attestation 2 shared controls
- session token 2 shared controls
- password manager 2 shared controls
Frameworks that govern passkey
What the standards actually require on passkey
Requirements naming passkey across 6 standards, quoted from the control text.
Discoverable credentials (formerly Resident Credentials) per WebAuthn L3 6.3 + CTAP2.1 are credentials whose private-key + per-credential metadata (rpId + userHandle + signCount) are stored on the authenticator.
FIDO2-Passkey-Discoverable · Passkeys (Discoverable Credentials) and Account Recovery →Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication confirms that each party to a communication (for example a person, device, service or application) really is who it claims to be, and gives assurance that no party is impersonating anothe...
X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →The supervisory guidelines (major banks III-3-8-2(2) and the parallel guidelines for regional banks, crypto-asset exchanges, electronic payment instrument businesses and cooperative financial institutions), as amended with immediate effect on 27 February 2026,...
japan-fsa-cybersecurity-guidelines-for-financial-institutions::SG.IB · Internet banking: phishing-resistant MFA and fraud prevention (supervisory guidelines, 27 February 2026) →Kuwait NCF Protect function (Access). Access Control and Identity Management aligned with NIST SP 800-53 AC family + ISO 27001 A.9 + Zero Trust principles.
KNCF-Protect-Access-Control-IAM-Privileged-MFA-Zero-Trust-Identity-Lifecycle-IAG-PAM · Kuwait NCF Protect + Access Control + IAM + Privileged + MFA + Zero Trust + Identity Lifecycle →Implement authentication per NIST SP 800-63-4 Volume B (Authentication and Authenticator Lifecycle). Approve authenticator types per Section 4 covering (a) memorised secrets (Section 4.1), (b) look-up secrets (Section 4.2), (c) out-of-band devices (Section 4.3...
NISTSP63R4-3 · Authentication: Authenticator Types, MFA, Phishing-Resistance, and Syncable Authenticators →OSPS-AC-01 Use MFA for Sensitive Actions (maturity levels 1, 2, 3). Requirement: When a user attempts to read or modify a sensitive resource in the project's authoritative repository, the system MUST require the user to complete a multi-factor authentication p...
openssf-open-source-project-security-baseline-osps-baseline::OSPS-AC-01.01 · OSPS-AC-01.01 Use MFA for Sensitive Actions →Questions people ask about passkey
What is Passkey?
Why is Passkey important for compliance?
Which compliance frameworks address Passkey?
Where can I learn more about Passkey?
See how Passkey applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.