Security hardware mapped to your compliance framework.

NIST SP 800-53 Rev 5

Security and privacy controls for federal information systems. Baseline for FedRAMP, DoD, and regulated US industries. The most granular US control catalog.

Federal agencies, defense contractors, FedRAMP ISVs

NIST Cybersecurity Framework 2.0

Voluntary risk management framework widely adopted by US enterprises. Updated in 2024 to add a Govern function and expand supply chain guidance.

All US organizations, increasingly global

ISO/IEC 27001:2022

International standard for information security management systems. Globally recognized certification. 2022 revision reorganized Annex A controls around four themes.

Global enterprises, EU market, APAC, financial services

SOC 2 (AICPA Trust Services Criteria)

AICPA audit standard for service organizations. Enterprise buyers increasingly require SOC 2 Type II. Five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, Privacy.

SaaS providers, cloud services, B2B service organizations

EU NIS2 Directive (2022/2555)

EU mandatory cybersecurity directive for essential and important entities. Effective October 2024. Covers endpoint security, supply chain, incident response, and management accountability.

EU-operating organizations in energy, transport, health, finance, digital infrastructure

Cybersecurity Maturity Model Certification 2.0

DoD certification required for all prime and sub-contractors handling CUI. Level 2 maps to NIST 800-171. Hardware controls are a key differentiator in assessments.

US defense industrial base, DoD prime and sub-contractors

PCI DSS v4.0.1 (Payment Card Industry Data Security Standard)

Mandatory for any organization that stores, processes, or transmits cardholder data. v4.x is the only active version; the 51 future-dated requirements became mandatory on 31 March 2025. Uniquely, PCI is explicit about phishing-resistant authentication: under Req 8.4.2 a FIDO2 authenticator can stand alone in place of MFA — the only major framework that credits hardware keys this directly.

Merchants, payment processors, service providers, any e-commerce operator

HIPAA Security Rule (45 CFR Part 164, Subpart C)

Technical, physical, and administrative safeguards for electronic protected health information. Mappings here are to the CURRENT rule in force. The December 2024 NPRM would add an explicit MFA mandate and remove the "addressable" status from encryption — but it is still a proposed rule: OCR received ~5,000 comments, and the federal agenda now shows final action no earlier than July 2027. Nothing on this page treats the proposal as a requirement.

Covered entities, business associates, health-tech vendors

EU Digital Operational Resilience Act (Regulation (EU) 2022/2554)

Binding EU regulation for financial entities, applicable since 17 January 2025. Article 9 requires strong authentication for remote and privileged access and protection of data at rest, in use, and in transit. Detailed requirements are set by the ICT risk management RTS, Commission Delegated Regulation (EU) 2024/1774.

EU banks, insurers, investment firms, crypto-asset providers, and their ICT suppliers

ASD Essential Eight Maturity Model (November 2023)

The Australian Signals Directorate's prioritized baseline — eight mitigation strategies across four maturity levels. The November 2023 revision bolstered MFA to require PHISHING-RESISTANT MFA, citing FIDO2/WebAuthn by name, and pulled that requirement down to a lower maturity level. Only eight strategies exist, so most hardware domains here are simply outside its scope.

Australian government entities and their suppliers, AU critical infrastructure

UK NCSC Cyber Essentials — Requirements for IT Infrastructure v3.3 (April 2026)

UK government-backed certification, required for many public-sector contracts. Five technical control themes. v3.3 applies to assessments registered from 26 April 2026 and defines passwordless authentication explicitly around "FIDO2 authenticators… security keys or tokens", with "a physically separate token" listed as an accepted MFA factor.

UK organizations, public-sector suppliers, MOD supply chain

CIS Critical Security Controls v8

Prioritized set of cybersecurity best practices. Three implementation groups mapped to organization size. Widely used as a practical baseline independent of regulatory requirement.

All organizations, security teams, SMBs