All frameworks UK

UK NCSC Cyber Essentials — Requirements for IT Infrastructure v3.3 (April 2026)

UK government-backed certification, required for many public-sector contracts. Five technical control themes. v3.3 applies to assessments registered from 26 April 2026 and defines passwordless authentication explicitly around "FIDO2 authenticators… security keys or tokens", with "a physically separate token" listed as an accepted MFA factor.

UK organizations, public-sector suppliers, MOD supply chain

control domains mapped

products applicable

other frameworks cross-mapped

Official doc

UK NCSC Cyber Essentials — Requirements for IT Infrastructure v3.3 (April 2026)

CE-4 User Access Control — passwordless authentication defined around FIDO2 authenticators and security keys; a physically separate token is an accepted MFA factor

Phishing-resistant MFA using hardware security keys. Software TOTP and SMS are explicitly excluded from "phishing-resistant" in NIST 800-63B and most modern framework guidance.

Products that satisfy this control:

Security key Nitrokey 3C NFC $80 Security key Nitrokey 3A NFC $75 Hardware security module Nitrokey HSM 2 $135 Security key Nitrokey 3A Mini $65 Security key Nitrokey Passkey $60 Security key Nitrokey 3A (No NFC) $90 Security key Nitrokey 3C (No NFC) $90 Amazon affiliate YubiKey Developer board Nitrokey 3A NFC Hacker $100

Same control in other frameworks:

NIST 800-53 IA-2(6) NIST CSF 2.0 PR.AA-03 ISO 27001 A.8.5 SOC 2 CC6.1 NIS2 Art.21(2)(i) CMMC 2.0 IA.L2-3.5.3 CIS Controls v8 CIS-6.3 PCI DSS 4.0.1 8.4.2 HIPAA Security Rule §164.312(d) DORA Art. 9(4)(d) Essential Eight E8-MFA

CE-2 Secure Configuration — devices, including BYOD and home/remote working, configured securely and in scope

Hardened mobile OS with per-app sensor controls, verified boot, and no background telemetry. Satisfies mobile device management and bring-your-own-device security requirements.

Products that satisfy this control:

Hardened phone NitroPhone 10 Pro $1,235 Hardened phone NitroPhone 10 Pro XL $1,750 Hardened phone NitroPhone 5a $965 Hardened phone NitroPhone 10 $1,035 Hardened phone NitroPhone 10 Pro Fold $2,000 Hardened phone NitroPhone 5 Pro $1,000 Hardened phone NitroPhone 5 Pro XL $1,380 Hardened tablet NitroTablet 1 $2,000 Hardened phone NitroPhone 10a $810 Privacy smartphone NovaCustom PrivacyGuard SHIFTphone 8.1 $889 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 AC-19 NIST CSF 2.0 PR.AC-3 ISO 27001 A.8.1 SOC 2 CC6.8 NIS2 Art.21(2)(e) CMMC 2.0 AC.L2-3.1.18 CIS Controls v8 CIS-4.4 PCI DSS 4.0.1 1.5.1 HIPAA Security Rule §164.310(d)(1)

CE-2 Secure Configuration — systems configured to reduce inherent vulnerabilities

Measured boot chain verified on every power-on. Any firmware modification — supply chain implant, evil-maid attack, or malicious update — fails attestation before the OS loads.

Products that satisfy this control:

Secure laptop NitroPad V54 (14") $2,285 Secure laptop NitroPad V56 (16") $2,330 Secure desktop NitroPC Pro 2 $2,230 Secure laptop NitroPad T480 $740 Secure laptop NitroPad T480s $690 Privacy laptop NovaCustom PrivacyGuard V54 $1,679 Privacy laptop NovaCustom PrivacyGuard V56 $1,729 Qubes OS laptop NovaCustom SecurityTitan V54 $2,695 Qubes OS laptop NovaCustom SecurityTitan V56 $2,749 Privacy mini PC NovaCustom PrivacyGuard NUC Box $1,259 Secure desktop NitroPC 2 $1,085 Hardened mobile GrapheneOS Pixels

Same control in other frameworks:

NIST 800-53 SI-7 NIST CSF 2.0 DE.CM-09 ISO 27001 A.8.8 SOC 2 CC7.1 NIS2 Art.21(2)(e) CMMC 2.0 SI.L2-3.14.6 CIS Controls v8 CIS-2.3 PCI DSS 4.0.1 11.5.2 HIPAA Security Rule §164.312(c)(1) DORA Art. 9(2)

CE-1 Firewalls — boundary firewalls and internet gateways protecting in-scope devices

Stateful firewall with IPS at the network perimeter. All inbound/outbound traffic inspected with Suricata rule sets. VPN gateway replaces consumer VPN dependency.

Products that satisfy this control:

Network security NitroWall V1410 $835 Network security NitroWall NW750 $375 Network security NitroWall VP4670 $1,540 Network Network appliances DIY Raspberry Pi builds

Same control in other frameworks:

NIST 800-53 SC-7 NIST CSF 2.0 PR.AC-5 ISO 27001 A.8.22 SOC 2 CC6.7 NIS2 Art.21(2)(e) CMMC 2.0 SC.L2-3.13.1 CIS Controls v8 CIS-12.3 PCI DSS 4.0.1 1.4.1 HIPAA Security Rule §164.312(e)(1) DORA Art. 9(4)(b)

Also mapped to

NIST 800-53 US NIST CSF 2.0 US ISO 27001 Global SOC 2 US NIS2 EU CMMC 2.0 US DoD PCI DSS 4.0.1 Payments HIPAA Security Rule US HHS DORA EU Essential Eight AU CIS Controls v8 Global