Skip to content

Passwordless Authentication

What is Passwordless Authentication?

Authentication methods that verify user identity without traditional passwords, using alternatives such as biometrics, hardware tokens, or magic links.

Information Security

Frameworks that govern passwordless authentication

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on passwordless authentication

Requirements naming passwordless authentication across 3 standards, quoted from the control text.

New Zealand Information Security Manual (NZISM)2 controls

When adopting passwordless authentication, agencies should perform a risk assessment and evaluate the available passwordless models so they can select the authentication mechanisms and factors that best suit the organisation's security and authentication needs...

new-zealand-information-security-manual-nzism::16.1.38.C.01 · 16.1.38.C.01 Risk-assess passwordless authentication options →
UK Cyber Essentials1 control

Where identity is established without a password, use a recognised passwordless method such as a FIDO2 authenticator or passkey, biometric, hardware security key or token, push notification or one-time code, and manage it as the authentication control for the...

CE-AC.8 · Passwordless Authentication →
ITU-T X.805 - Security Architecture for End-to-End Communications1 control

Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication confirms that each party to a communication (for example a person, device, service or application) really is who it claims to be, and gives assurance that no party is impersonating anothe...

X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →

Questions people ask about passwordless authentication

What is Passwordless Authentication?
Authentication methods that verify user identity without traditional passwords, using alternatives such as biometrics, hardware tokens, or magic links.
Why is Passwordless Authentication important for compliance?
Passwordless Authentication is a key concept in Information Security. Understanding passwordless authentication helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Passwordless Authentication?
Passwordless Authentication appears in the requirement text of New Zealand Information Security Manual (NZISM), UK Cyber Essentials, ITU-T X.805 - Security Architecture for End-to-End Communications. Across these standards we have identified 4 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Passwordless Authentication?
Explore our compliance framework pages to see how passwordless authentication applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Passwordless Authentication applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.