NIS2 Compliance with FIDO2: Article 21 Mapping
TL;DR · the short version
NIS2 (the EU Network and Information Security Directive 2) does not name FIDO2 or passkeys explicitly, but its Article 21 risk-management obligations make phishing-resistant MFA the natural way essential and important entities meet access-control expectations. FIDO2/WebAuthn credentials — hardware keys and passkeys — bind authentication to the origin, so a credential phished on a lookalike domain will not work. The guide maps FIDO2 to the relevant NIS2 measures and gives a rollout order starting with admins and remote access before the general workforce.
NIS2 does not contain the words "FIDO2" or "passkey" anywhere. What it does contain, in Article 21, is a requirement for essential and important entities to put in place appropriate and proportionate technical, operational and organisational measures — explicitly including access-control policies and the use of multi-factor or continuous authentication "where appropriate." For most organisations, the cleanest way to satisfy the strong end of that expectation is phishing-resistant authentication, and in practice that means FIDO2/WebAuthn: hardware security keys and passkeys.
Why phishing-resistant, and why now
The dominant way accounts get taken over is not password guessing — it is phishing and adversary-in-the-middle kits that relay a legitimate login, including the one-time code or push approval, in real time. App-based OTP and push MFA raise the bar but do not remove this path. A FIDO2 credential does, because it is bound to the origin it was registered with. On a lookalike domain the browser will not release it, so there is nothing to relay. That single property is why regulators and frameworks increasingly describe phishing-resistant MFA as the target state, and why it is the most defensible answer to a NIS2 assessor asking how you control access to important systems.
Mapping FIDO2 to NIS2 Article 21
- Access control & MFA: FIDO2 directly implements the "multi-factor authentication where appropriate" measure, at the strongest tier.
- Identity of privileged users: device-bound hardware keys give administrators an authenticator that cannot be silently copied off a laptop.
- Business continuity & resilience: registering two or more authenticators per user is both a lockout-avoidance practice and evidence of the resilience NIS2 expects.
- Supply chain & remote access: phishing-resistant sign-in for VPN, VDI and third-party portals shrinks the most-exploited entry points.
A rollout order that survives an audit
- Administrators and PAM first. Hardware security keys for domain/cloud admins and privileged-access tooling. Highest blast radius, smallest population.
- Remote and VPN access. Enforce FIDO2 at the identity provider for anything reachable from outside the network.
- General workforce passkeys. Roll out synced passkeys for primary IdP sign-in; this is where adoption and phishing-resistance scale.
- Two authenticators per user. A platform passkey plus a roaming key removes lockouts and reads as resilience, not just authentication.
- Disable weaker fallbacks. The control only holds if SMS/OTP fallback is removed for the accounts you have hardened — an assessor will check this.
What to measure
Track FIDO2 coverage by population (admins, remote users, all staff), the number of accounts still allowed a phishable fallback, and the number of users with fewer than two authenticators. Those three numbers are the honest picture of how much of your NIS2 access-control obligation FIDO2 actually covers.
For the wider build-vs-buy view and authenticator options, see our FIDO2 & passkeys for the workforce, and quantify where weak identity controls sit with the Identity Risk tool →
Frequently asked questions
Does NIS2 require FIDO2 specifically? No — NIS2 is technology-neutral. Article 21 requires multi-factor or continuous authentication where appropriate; FIDO2/WebAuthn is the most common way to meet the phishing-resistant end of that expectation.
Why is FIDO2 phishing-resistant? The credential is bound to the website origin, so it cannot be released on a lookalike domain or relayed by an attacker-in-the-middle.
Where should we deploy it first? Administrators and privileged access, then remote/VPN, then the general workforce — with at least two authenticators per user.
Passkeys or hardware keys? Both are FIDO2. Passkeys for broad adoption; hardware keys for administrators and high-risk roles.
Frequently asked questions
How does FIDO2 support NIS2 regulations?
NIS2 is technology-neutral, but its Article 21 requires appropriate, proportionate access-control measures including multi-factor or continuous authentication "where appropriate" — and FIDO2/WebAuthn is the most widely deployed way to meet the strong, phishing-resistant end of that. It maps to several NIS2 measures: phishing-resistant MFA for access control, device-bound hardware keys for privileged and administrator identities, phishing-resistant sign-in for remote and supply-chain access, and — by registering two or more authenticators per user — the resilience NIS2 expects. A defensible rollout starts with admins and remote access, then the general workforce, and removes phishable SMS/OTP fallbacks on the accounts you have hardened.
Why is FIDO2 called "phishing-resistant"?
A FIDO2 credential is cryptographically bound to the website origin it was registered with. When a user is lured to a lookalike domain, the browser will not release the credential because the origin does not match, so there is nothing for an attacker-in-the-middle to relay or replay. App-based one-time codes and push approvals do not have this binding and can be phished or fatigue-bombed.
Where should we deploy FIDO2 first for NIS2?
Start with the highest-blast-radius identities: domain and cloud administrators, privileged access management, and remote/VPN access. Then extend to all employees for their primary identity provider sign-in. Registering at least two authenticators per user (for example a platform passkey plus a roaming security key) avoids lockouts and is itself a resilience measure NIS2 assessors look for.
Do passkeys count, or do we need hardware keys?
Both are FIDO2/WebAuthn credentials. Synced passkeys give the best adoption and cover most of the workforce; hardware security keys give the strongest assurance and device-bound guarantees for administrators and high-risk roles. Many NIS2 programmes use passkeys broadly and reserve hardware keys for privileged accounts.