FIDO2
FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password. Requirements v3.3 added FIDO2 to the definition of passwordless authentication and states that FIDO2 authenticators are regarded as MFA. It fits option D, passwordless, at A4.3 and A5.5.
- Term
- FIDO2
- Also known as
- FIDO2 authenticator, WebAuthn, FIDO security key
- Category
- Accounts and access
- Requirement area
- B. Definitions; 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term FIDO2 mean in Cyber Essentials?
FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password.
FIDO2 is a set of standards that define cryptographic authentication using public key credentials and protocols to provide more secure alternatives to passwords for accessing online services
How does FIDO2 apply to Cyber Essentials?
In plain terms
FIDO2 is the plumbing behind passkeys and USB security keys. You do not need to understand the maths. What matters is that your device proves who you are by answering a one-off challenge with a secret key it never shares, and you confirm with a touch, a fingerprint or a PIN. A FIDO2 authenticator can be a small USB or NFC key on your keyring, or it can be built into a phone or laptop.
What Cyber Essentials asks
Section B of the v3.3 requirements now names "FIDO2 authenticators" first in its examples of passwordless authentication. The user access control section adds the definition quoted above and two further statements: FIDO2 authenticators "are considered as Passkeys", and "FIDO2 authenticators are regarded as MFA because user authentication is performed."
This matters for cloud services, where "authentication to cloud services must always use MFA" and a No to A7.16 or A7.17 is an automatic fail. In the question set, A4.3 and A5.5 offer option D, "passwordless", which needs a description in the notes field. Name the method, for example FIDO2 security keys or passkeys, and the systems it covers.
At Cyber Essentials Plus, test case 4 looks for "a form of MFA" before access to each cloud service is granted, so plan who will sign in during the test and with which key.
Common mistakes
- Leaving a password fallback with no brute-force protection. A7.10 covers passwords that back up a passwordless system.
- Issuing one security key per person with no spare or recovery route, then switching MFA off when a key is lost.
See does passwordless authentication count and what changed in 2026. Related: passkey, passwordless authentication, multi-factor authentication.
Related terms
- PasskeyA passkey is a way to sign in without a password: your phone or computer holds a secret digital key, and you unlock it with your fingerprint, face or device PIN.
- Passwordless authenticationPasswordless authentication is a method to establish a user's identity that uses a factor other than knowledge, such as FIDO2 authenticators, biometrics, security keys, one-time codes, QR codes or push notifications.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
- Group policyGroup policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
Frequently asked questions
FIDO2 is a set of open standards for signing in with a cryptographic key held on your device or on a physical security key, instead of typing a password. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, FIDO2 comes up at A4.3, A5.5. Read those questions against the definition above so your answers use the term the way the assessor will.
FIDO2 relates to B. Definitions; 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.