FIDO2 security keys: ordering and enrollment

Overview

Phishing-resistant MFA via FIDO2 keys reduces push fatigue compromises.

Procurement

Standardize two approved models for inventory/spares; firmware updatable keys only.

Enrollment

Temporary access level for self-enrollment kiosks; supervisor attestation for executives.

Recovery

Register two keys per user or pair with passkeys across devices; lost key revoke within minutes.

Helpdesk

Cheap backup path documented—don’t strand travelers.