Transitioning to Passkeys for ISO 27001 Compliance in Organizations

Organizations are shifting from traditional password-based authentication to passkey technology, which offers enhanced security and aligns with ISO/IEC 27001 compliance requirements. Passwords have long been a weak link in security, with Verizon’s 2023 Data Breach Investigations Report indicating that 49% of security incidents stem from compromised passwords. As businesses grow, the need for more secure authentication methods becomes critical.

Passkeys, built on FIDO2 and WebAuthn standards, are designed to eliminate the vulnerabilities associated with passwords. They utilize cryptographic key pairs, where the private key remains on the user’s device, making it nearly impossible for attackers to intercept or phish. Notably, more than 15 billion online accounts now support passkeys, with Google enabling 800 million accounts and Amazon creating 175 million passkeys.

Compliance with ISO/IEC 27001

For organizations certified under ISO/IEC 27001, transitioning to passkeys requires careful alignment with existing controls. The 2022 revision of ISO/IEC 27001 reorganized controls into four themes: organizational, people, physical, and technological. Key controls relevant to authentication include Annex A 5.15, which defines access control policies, Annex A 5.17, which mandates procedures for managing authentication credentials, and Annex A 8.5, which specifies secure authentication requirements.

Implementing passkeys involves documenting the enrollment process, establishing encryption standards for public key storage, and ensuring compliance with multi-factor authentication requirements. Organizations must also assess risks associated with device loss and establish monitoring procedures for new attack vectors.

While passkeys significantly improve security, challenges remain. Users may face account recovery complexities if they lose their device, and mixed authentication environments can create inconsistent security postures. Organizations must proactively address these issues through clear policies and training.

Ultimately, the transition to passkeys represents a fundamental shift in authentication security, offering measurable improvements in user experience and operational efficiency. Organizations that prioritize risk-based implementation and thorough documentation will be better positioned to meet compliance standards and enhance their security frameworks.

• Define passkey scope based on risk levels, using device-bound passkeys for privileged accounts and syncable passkeys for standard users.
• Document the enrollment process for passkeys, including identity verification steps and triggers for re-enrollment.
• Establish clear policies for fallback authentication methods during the transition to passkeys.
• Monitor for downgrade attacks that may force users back to password authentication.
• Regularly test account recovery procedures to ensure they are effective and secure.