Skip to content

Passwordless Authentication

What is Passwordless Authentication?

Authentication methods that verify user identity without traditional passwords, using alternatives such as biometrics, hardware tokens, or magic links.

Information Security

Frameworks that govern passwordless authentication

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on passwordless authentication

Requirements naming passwordless authentication across 3 standards, quoted from the control text.

UK Cyber Essentials1 control

Where identity is established without a password, use a recognised passwordless method such as a FIDO2 authenticator or passkey, biometric, hardware security key or token, push notification or one-time code, and manage it as the authentication control for the...

CE-AC.8 · Passwordless Authentication →
ITU-T X.805 - Security Architecture for End-to-End Communications1 control

Security Dimension 2 Authentication per X.805 Clause 6.2: Authentication ensures the validity of the claimed identities of the entities participating in communication (e.g.

X805-Dim2-Authentication-Identity-Verification-Claimed-Identities-Entities-Communication · ITU-T X.805 Security Dimension 2 - Authentication + Identity Verification + Claimed Identity + Entity Authentication + Data Origin Authentication + Mutual Authentication + Multi-Factor + Cryptographic Authentication →
Secure by Design: A Guide for Manufacturers (CISA)1 control

Implement phishing-resistant authentication (FIDO2/WebAuthn, PKI) as the default. Support passwordless authentication where feasible.

SBD-DEV-04 · Phishing-Resistant Authentication →

Questions people ask about passwordless authentication

What is Passwordless Authentication?
Authentication methods that verify user identity without traditional passwords, using alternatives such as biometrics, hardware tokens, or magic links.
Why is Passwordless Authentication important for compliance?
Passwordless Authentication is a key concept in Information Security. Understanding passwordless authentication helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Passwordless Authentication?
Passwordless Authentication appears in the requirement text of UK Cyber Essentials, ITU-T X.805 - Security Architecture for End-to-End Communications, Secure by Design: A Guide for Manufacturers (CISA). Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Passwordless Authentication?
Explore our compliance framework pages to see how passwordless authentication applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Passwordless Authentication applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.