Back to Frameworks
FIDO2 / WebAuthn — Passwordless Authentication Standard
International (FIDO Alliance/W3C)
vLevel 2 (2024)
4 domains
11 controls
FIDO2 is the passwordless authentication standard developed by the FIDO Alliance and W3C. FIDO2 consists of two components: WebAuthn (W3C Web Authentication API) and CTAP2 (Client-to-Authenticator Protocol). FIDO2 enables passwordless, phishing-resistant authentication using public key cryptography. Supported by all major browsers (Chrome, Firefox, Safari, Edge), operating systems (Windows Hello, macOS/iOS Face ID/Touch ID, Android biometrics), and platforms (Google Passkeys, Apple Passkeys, Microsoft Passkeys). Over 12 billion accounts can use FIDO2. FIDO Alliance has 300+ member companies. FIDO2 passkeys are the recommended replacement for passwords by NIST, CISA, and ENISA.
Verified
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (4)
CTAP2 (Client to Authenticator Protocol)
4 controls
| Code | Title |
|---|---|
| FIDO2-2.1 | Authenticator API |
| FIDO2-2.2 | Transport Bindings |
| FIDO2-2.3 | PIN/UV Protocol |
| FIDO2-2.4 | Credential Management |
Passkey and Platform Integration
3 controls
| Code | Title |
|---|---|
| FIDO2-4.1 | Discoverable Credentials (Passkeys) |
| FIDO2-4.2 | Platform Authenticator Integration |
| FIDO2-4.3 | Cross-Device Authentication |
Security Requirements
0 controls
QKD module and network security
WebAuthn API (W3C)
4 controls
| Code | Title |
|---|---|
| FIDO2-1.1 | Credential Creation (Registration) |
| FIDO2-1.2 | Credential Assertion (Authentication) |
| FIDO2-1.3 | Attestation |
| FIDO2-1.4 | Extensions |
Maps to 179 other frameworks
11 total controls
CSA CCM v4
3 source controls mapped|3 target controls covered
27%
CISA ICS-CERT Advisories and Industrial Control Systems Security Guidelines
3 source controls mapped|3 target controls covered
27%
NIS2 Directive Implementing Acts
3 source controls mapped|4 target controls covered
27%
FBI CJIS Security Policy
3 source controls mapped|3 target controls covered
27%
FedRAMP Rev 5
3 source controls mapped|4 target controls covered
27%
US Maritime Transportation Security Act (MTSA) and USCG Cybersecurity Requirements
3 source controls mapped|1 target controls covered
27%
FCC Customer Proprietary Network Information (CPNI) and Data Breach Rules (47 CFR 64.2001-2011)
3 source controls mapped|3 target controls covered
27%
OWASP DevSecOps Maturity Model (DSOMM)
3 source controls mapped|1 target controls covered
27%
EMV 3-D Secure (3DS2) — Payment Authentication Protocol
3 source controls mapped|3 target controls covered
27%
ISO/IEC 29115:2023 — Entity Authentication Assurance Framework
3 source controls mapped|3 target controls covered
27%
CWE Top 25 Most Dangerous Software Weaknesses (2024)
3 source controls mapped|3 target controls covered
27%
Chile Personal Data Protection Law (Law No. 21.719)
3 source controls mapped|1 target controls covered
27%
BSIMM
3 source controls mapped|1 target controls covered
27%
ETSI EN 303 645
3 source controls mapped|1 target controls covered
27%
3GPP 5G Security Architecture (TS 33.501)
3 source controls mapped|3 target controls covered
27%
3GPP Security Architecture (TS 33.501 — 5G Security)
3 source controls mapped|2 target controls covered
27%
OWASP ASVS
3 source controls mapped|1 target controls covered
27%
US EPA Safe Drinking Water Act (SDWA) — Cybersecurity Requirements
3 source controls mapped|1 target controls covered
27%
Australian Energy Sector Cyber Security Framework (AESCSF)
3 source controls mapped|1 target controls covered
27%
CAIQ (CSA)
3 source controls mapped|1 target controls covered
27%
Digital Economy Partnership Agreement (DEPA)
3 source controls mapped|1 target controls covered
27%
WCO Authorised Economic Operator (AEO) Framework
3 source controls mapped|1 target controls covered
27%
NRF Cybersecurity and Data Privacy Framework (National Retail Federation)
3 source controls mapped|1 target controls covered
27%
WCO SAFE Framework of Standards to Secure and Facilitate Global Trade (2021)
3 source controls mapped|1 target controls covered
27%
Customs-Trade Partnership Against Terrorism (C-TPAT)
3 source controls mapped|1 target controls covered
27%
EU Critical Raw Materials Act (Regulation (EU) 2024/1252)
3 source controls mapped|1 target controls covered
27%
EU Chips Act (Regulation (EU) 2023/1781)
3 source controls mapped|1 target controls covered
27%
UK Telecommunications (Security) Act 2021
3 source controls mapped|2 target controls covered
27%
BSI IT-Grundschutz
3 source controls mapped|1 target controls covered
27%
NIST SP 800-171A Rev 3 — Assessing CUI Security Requirements
3 source controls mapped|2 target controls covered
27%
ISO/IEC 23837 — Security Requirements for Quantum Key Distribution
3 source controls mapped|1 target controls covered
27%
EU European Health Data Space (EHDS)
3 source controls mapped|1 target controls covered
27%
NIST SP 800-171A — Assessing CUI Security Requirements
3 source controls mapped|3 target controls covered
27%
Belgium CyberFundamentals
3 source controls mapped|1 target controls covered
27%
HL7 FHIR Security Framework
3 source controls mapped|3 target controls covered
27%
ASD Strategies to Mitigate Cyber Security Incidents
3 source controls mapped|2 target controls covered
27%
California IoT Security Law
3 source controls mapped|1 target controls covered
27%
DFARS 252.204-7012 — Safeguarding Covered Defense Information
3 source controls mapped|3 target controls covered
27%
Connecticut Data Privacy Act (CTDPA)
3 source controls mapped|5 target controls covered
27%
Illinois Biometric Information Privacy Act (BIPA)
3 source controls mapped|3 target controls covered
27%
NAIC Insurance Data Security Model Law (MDL-668)
3 source controls mapped|3 target controls covered
27%
Modern Slavery Act 2018 (Australia)
3 source controls mapped|3 target controls covered
27%
AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association)
3 source controls mapped|1 target controls covered
27%
TEFCA — Trusted Exchange Framework and Common Agreement
3 source controls mapped|2 target controls covered
27%
DAMA-DMBOK2 — Data Management Body of Knowledge (2nd Edition)
3 source controls mapped|1 target controls covered
27%
CMMC 2.0
3 source controls mapped|1 target controls covered
27%
FDA 21 CFR Part 11
3 source controls mapped|1 target controls covered
27%
OWASP API Security Top 10:2023
3 source controls mapped|1 target controls covered
27%
CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0
3 source controls mapped|3 target controls covered
27%
ASD Essential Eight Maturity Model
3 source controls mapped|3 target controls covered
27%
USMCA Chapter 19 — Digital Trade (United States-Mexico-Canada Agreement)
3 source controls mapped|1 target controls covered
27%
EN 301 549 — ICT Accessibility Requirements
3 source controls mapped|1 target controls covered
27%
CISA Zero Trust Maturity Model
3 source controls mapped|1 target controls covered
27%
Bank Secrecy Act / Anti-Money Laundering (BSA/AML)
3 source controls mapped|1 target controls covered
27%
MITRE D3FEND
3 source controls mapped|1 target controls covered
27%
IACS Unified Requirements E26/E27 — Cyber Resilience of Ships and On-Board Systems
3 source controls mapped|1 target controls covered
27%
US Consumer Product Safety Commission (CPSC) — Connected Product Safety
3 source controls mapped|1 target controls covered
27%
AML/CTF Act 2006 (Australia)
3 source controls mapped|1 target controls covered
27%
Colorado Privacy Act (CPA)
3 source controls mapped|4 target controls covered
27%
Vermont Artificial Intelligence and Consumer Data Act (AICDA)
3 source controls mapped|2 target controls covered
27%
US Gramm-Leach-Bliley Act (GLBA) — Higher Education Safeguards Rule
3 source controls mapped|3 target controls covered
27%
NYDFS Cybersecurity Regulation (23 NYCRR Part 500)
3 source controls mapped|3 target controls covered
27%
HIPAA Security Rule
3 source controls mapped|3 target controls covered
27%
3GPP Security
3 source controls mapped|1 target controls covered
27%
EBA Guidelines on ICT and Security Risk Management (EBA/GL/2019/04)
3 source controls mapped|1 target controls covered
27%
Cyber Essentials Plus
3 source controls mapped|1 target controls covered
27%
ISO/IEC 27400:2022
3 source controls mapped|1 target controls covered
27%
AWS Well-Architected Security Pillar
3 source controls mapped|1 target controls covered
27%
ASIC Cyber Resilience Good Practices
3 source controls mapped|1 target controls covered
27%
EU Cyber Resilience Act
3 source controls mapped|1 target controls covered
27%
eIDAS 2.0 — EU Digital Identity Regulation
3 source controls mapped|1 target controls covered
27%
DoD Zero Trust Reference Architecture
3 source controls mapped|1 target controls covered
27%
Azure Security Benchmark
3 source controls mapped|1 target controls covered
27%
Spain ENS
3 source controls mapped|1 target controls covered
27%
Armenia Law on Protection of Personal Data (2015)
3 source controls mapped|2 target controls covered
27%
OWASP Top 10:2025
3 source controls mapped|2 target controls covered
27%
C5 (Germany)
3 source controls mapped|1 target controls covered
27%
Lebanon Electronic Transactions and Personal Data Protection Law (Law No. 81/2018)
3 source controls mapped|2 target controls covered
27%
Wisconsin Data Privacy Act (SB 670)
3 source controls mapped|3 target controls covered
27%
Tennessee Information Protection Act (TIPA)
3 source controls mapped|2 target controls covered
27%
ANSSI Cybersecurity Framework
3 source controls mapped|1 target controls covered
27%
Russia Federal Law on Personal Data (152-FZ)
3 source controls mapped|1 target controls covered
27%
CSA STAR (Security, Trust, Assurance, and Risk)
3 source controls mapped|1 target controls covered
27%
EU Maritime Single Window Environment Regulation (EU 2019/1239) and EMSA Cybersecurity
3 source controls mapped|1 target controls covered
27%
NIST SP 800-53 Rev 5
3 source controls mapped|3 target controls covered
27%
DISA Security Technical Implementation Guides (STIGs)
3 source controls mapped|3 target controls covered
27%
NIST SP 800-161
3 source controls mapped|1 target controls covered
27%
PAS 1192-5:2015 — Security-Minded Approach to BIM and Digital Built Environments
3 source controls mapped|2 target controls covered
27%
Canada ITSG-33 — IT Security Risk Management
3 source controls mapped|2 target controls covered
27%
New Zealand Information Security Manual (NZISM)
3 source controls mapped|2 target controls covered
27%
MARS-E — Minimum Acceptable Risk Standards for Exchanges
3 source controls mapped|2 target controls covered
27%
South Korea Cloud Security Assurance Program (CSAP)
3 source controls mapped|2 target controls covered
27%
NRC 10 CFR 73.54 — Nuclear Facility Cybersecurity
3 source controls mapped|2 target controls covered
27%
UK Gambling Commission — Cyber Resilience Requirements
3 source controls mapped|1 target controls covered
27%
NIST Privacy Framework 1.0
3 source controls mapped|2 target controls covered
27%
US Executive Order 14028 — Improving the Nation's Cybersecurity
3 source controls mapped|1 target controls covered
27%
OWASP MASVS
3 source controls mapped|1 target controls covered
27%
OpenSSF Scorecard
3 source controls mapped|1 target controls covered
27%
SSDF (NIST)
3 source controls mapped|1 target controls covered
27%
NIST SP 800-137
3 source controls mapped|1 target controls covered
27%
O-RAN Alliance Security Specifications (O-RAN.WG11)
3 source controls mapped|1 target controls covered
27%
NIST SP 800-146
3 source controls mapped|1 target controls covered
27%
Ghana Cybersecurity Act
3 source controls mapped|1 target controls covered
27%
ASD Information Security Manual (ISM)
3 source controls mapped|4 target controls covered
27%
FIDO2 and W3C WebAuthn Standard
3 source controls mapped|3 target controls covered
27%
W3C Verifiable Credentials (VC) Data Model 2.0
3 source controls mapped|3 target controls covered
27%
ISMAP (Japan)
3 source controls mapped|1 target controls covered
27%
OWASP Top 10 for LLM Applications 2025
3 source controls mapped|2 target controls covered
27%
PropTech Security Standards — Smart Building Cybersecurity
3 source controls mapped|2 target controls covered
27%
CCSDS 350.0-G-3 — Space Communications Security (Consultative Committee for Space Data Systems)
3 source controls mapped|3 target controls covered
27%
Florida Digital Bill of Rights (SB 262)
3 source controls mapped|2 target controls covered
27%
NIST SP 800-53A
3 source controls mapped|1 target controls covered
27%
ISO 27002:2022
3 source controls mapped|1 target controls covered
27%
South Korea ISMS-P
3 source controls mapped|1 target controls covered
27%
MTCS (Singapore)
3 source controls mapped|1 target controls covered
27%
RFC 2350 — Expectations for Computer Security Incident Response (BCP 21)
3 source controls mapped|1 target controls covered
27%
SSAE 18 — Attestation Standards (SOC Reporting)
3 source controls mapped|1 target controls covered
27%
CISA Secure by Design Principles
3 source controls mapped|3 target controls covered
27%
NIST Privacy Framework Version 1.0
3 source controls mapped|1 target controls covered
27%
NIST SP 800-181
3 source controls mapped|1 target controls covered
27%
NIST SP 800-172
3 source controls mapped|1 target controls covered
27%
ISO 27017
3 source controls mapped|1 target controls covered
27%
SWIFT Customer Security Programme (CSP)
3 source controls mapped|3 target controls covered
27%
UK Open Banking Standard
3 source controls mapped|3 target controls covered
27%
Zimbabwe Data Protection Act (2021)
3 source controls mapped|1 target controls covered
27%
EU PSD3 and Payment Services Regulation (Proposed)
3 source controls mapped|3 target controls covered
27%
NIST SP 800-124 Rev 2 — Mobile Device Security
3 source controls mapped|1 target controls covered
27%
NIST SP 800-115
3 source controls mapped|1 target controls covered
27%
NIST SP 800-92
3 source controls mapped|1 target controls covered
27%
TSA Pipeline Cybersecurity Directives
3 source controls mapped|1 target controls covered
27%
UK PSTI Act
3 source controls mapped|1 target controls covered
27%
Saudi NCA ECC
3 source controls mapped|1 target controls covered
27%
NIST SP 800-190
3 source controls mapped|1 target controls covered
27%
NIST SP 800-150
3 source controls mapped|1 target controls covered
27%
SIG (Shared Assessments)
3 source controls mapped|1 target controls covered
27%
PCI DSS v4.0
3 source controls mapped|3 target controls covered
27%
MITRE ATT&CK
3 source controls mapped|1 target controls covered
27%
ISO 27001:2022
3 source controls mapped|2 target controls covered
27%
TSA Pipeline Security
3 source controls mapped|1 target controls covered
27%
GLI-33 — Gaming Laboratories International Event Wagering Systems
3 source controls mapped|1 target controls covered
27%
ITU-T X.805 — Security Architecture for End-to-End Communications
3 source controls mapped|1 target controls covered
27%
FTC GLBA Safeguards Rule (16 CFR Part 314)
3 source controls mapped|1 target controls covered
27%
CNCF Cloud Native Security (Cloud Native Computing Foundation)
3 source controls mapped|1 target controls covered
27%
NIST SP 800-61
3 source controls mapped|1 target controls covered
27%
NIST SP 800-82 Rev 3 — Guide to OT Security
3 source controls mapped|2 target controls covered
27%
NIST SP 800-144
3 source controls mapped|1 target controls covered
27%
MDS2 (Medical Device)
3 source controls mapped|1 target controls covered
27%
FAA Cybersecurity Framework for Aviation
3 source controls mapped|1 target controls covered
27%
Oman National Cybersecurity Framework
3 source controls mapped|1 target controls covered
27%
NIST SP 800-66
3 source controls mapped|1 target controls covered
27%
FISMA
3 source controls mapped|1 target controls covered
27%
TISAX — Trusted Information Security Assessment Exchange
3 source controls mapped|1 target controls covered
27%
FTC Safeguards Rule (16 CFR Part 314)
3 source controls mapped|1 target controls covered
27%
OWASP SAMM
3 source controls mapped|1 target controls covered
27%
ISO 27043
3 source controls mapped|1 target controls covered
27%
NIST Cybersecurity Framework 2.0
3 source controls mapped|2 target controls covered
27%
ISO 27018
3 source controls mapped|1 target controls covered
27%
UNECE WP.29 R156
3 source controls mapped|1 target controls covered
27%
IRS Publication 1075 — Tax Information Security Guidelines
3 source controls mapped|1 target controls covered
27%
Regional Comprehensive Economic Partnership (RCEP) — E-Commerce Chapter
3 source controls mapped|1 target controls covered
27%
ISO/SAE 21434
3 source controls mapped|1 target controls covered
27%
NIST SP 800-128
3 source controls mapped|1 target controls covered
27%
ISO 27799
3 source controls mapped|1 target controls covered
27%
NIST SP 800-207
3 source controls mapped|1 target controls covered
27%
UNECE WP.29 R155
3 source controls mapped|1 target controls covered
27%
NIST SP 800-187
3 source controls mapped|1 target controls covered
27%
NIST SP 800-123
3 source controls mapped|1 target controls covered
27%
NIST SP 800-88
3 source controls mapped|1 target controls covered
27%
NIST SP 800-160
3 source controls mapped|1 target controls covered
27%
NIST SP 800-145
3 source controls mapped|1 target controls covered
27%
MARS-E
3 source controls mapped|1 target controls covered
27%
WCAG 2.2
3 source controls mapped|2 target controls covered
27%
ISO 13485
3 source controls mapped|1 target controls covered
27%
NIST SP 800-63
3 source controls mapped|1 target controls covered
27%
SLSA
3 source controls mapped|1 target controls covered
27%
NIST SP 800-218
3 source controls mapped|1 target controls covered
27%
PTES
3 source controls mapped|1 target controls covered
27%
NIST SP 800-171
3 source controls mapped|1 target controls covered
27%
NIST SP 800-183
3 source controls mapped|1 target controls covered
27%
Frequently Asked Questions
What is FIDO2 / WebAuthn — Passwordless Authentication Standard?
FIDO2 / WebAuthn — Passwordless Authentication Standard is a compliance framework from International (FIDO Alliance/W3C) with 4 domains and 11 controls. FIDO2 is the passwordless authentication standard developed by the FIDO Alliance and W3C. FIDO2 consists of two components: WebAuthn (W3C Web Authentication API) and CTAP2 (Client-to-Authenticator Protocol). FIDO2 enables passwordless, phishing-resistant authentication using public key cryptography. Supported by all major browsers (Chrome, Firefox, Safari, Edge), operating systems (Windows Hello, macOS/iOS Face ID/Touch ID, Android biometrics), and platforms (Google Passkeys, Apple Passkeys, Microsoft Passkeys). Over 12 billion accounts can use FIDO2. FIDO Alliance has 300+ member companies. FIDO2 passkeys are the recommended replacement for passwords by NIST, CISA, and ENISA. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
How many controls does FIDO2 / WebAuthn — Passwordless Authentication Standard have?
FIDO2 / WebAuthn — Passwordless Authentication Standard has 11 controls organised across 4 domains. The largest domains are CTAP2 (Client to Authenticator Protocol) (4 controls), WebAuthn API (W3C) (4 controls), Passkey and Platform Integration (3 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
What frameworks does FIDO2 / WebAuthn — Passwordless Authentication Standard map to?
FIDO2 / WebAuthn — Passwordless Authentication Standard maps to 179 other compliance frameworks. The top mapping partners are CSA CCM v4 (27% coverage), CISA ICS-CERT Advisories and Industrial Control Systems Security Guidelines (27% coverage), NIS2 Directive Implementing Acts (27% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I get started with FIDO2 / WebAuthn — Passwordless Authentication Standard compliance?
Start your FIDO2 / WebAuthn — Passwordless Authentication Standard compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about FIDO2 / WebAuthn — Passwordless Authentication Standard requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 11 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 692 frameworks.
Get Started Free →Free forever — no credit card required