Topic starter
26/08/2026 11:51 am
TL;DR: The DoW CIO’s new MFA memo approves device-bound FIDO2 passkeys on YubiKeys for DoD use cases, clarifies DoD PKI as the primary credential, and expands guidance across shared devices, BYO mobile, and privileged access scenarios, according to Yubico. The policy shift matters because it removes ambiguity around passwordless authentication, but identity teams still need to map use cases, credential lifecycle, and device-bound assurance to their own governance model.
Editorial analysis by NHI Mgmt Group, based on content published by Yubico: “YubiKey FIPS Series named sole authenticator authorized to hold both DoD PKI and FIDO2 passkeys”.
Key questions
Q: How should IAM teams govern passkeys across multiple platforms?
A: Treat passkeys as lifecycle-managed authenticators, not as a one-time login feature.
Q: Why does clarifying the primary credential matter for passwordless rollout?
A: Because credential hierarchy determines onboarding, fallback, recovery, and audit logic.
Q: What breaks when shared devices and BYO mobile use the same access policy?
A: Shared devices and BYO mobile have different custody, recovery, and trust boundaries, so a single policy usually creates gaps.
Practitioner guidance
- Map each approved use case to a distinct access policy Separate shared government mobile devices, BYO mobile, privileged users, and workstation logon into different policy paths instead of treating them as one passwordless rollout.
- Define the primary credential in policy text State whether DoD PKI, CAC, or another credential class anchors trust for onboarding, authentication, fallback, and recovery so authorising officials are not improvising interpretations.
- Treat hardware-bound passkeys as a managed authenticator class Track issuance, custody, replacement, and deprovisioning for YubiKey-style authenticators with the same discipline used for other high-assurance credentials.
Bottom line: The memo reduces ambiguity about approved authentication methods, but policy clarity only helps if IAM teams translate it into enforceable credential rules.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Policy clarity is now the gating control for phishing-resistant adoption in regulated environments. The memo does more than approve a technology option. It removes a long-standing ambiguity about what is authorised and for which use case, which is often the real blocker in mature IAM programmes. Once the policy boundary is explicit, identity teams can govern rollout without relying on local exceptions or informal interpretations. The practitioner conclusion is that governance language now becomes the deployment control.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: Should organisations require FIPS-certified authenticators for high-assurance access?
A: Yes, when the use case depends on regulated or high-assurance access and the policy requires a certified authenticator class. Certification does not replace lifecycle governance, but it helps standardise assurance and reduce ambiguity about which devices are acceptable for sensitive logon flows.
👉 Read our full editorial: DoD MFA memo changes the case for phishing-resistant passkeys