Before granting organizational access, verify both that the person is who they claim to be and that the device meets your security policy. Identity proofing, login authentication, device posture, and authorization are separate checks; none alone establishes that a request is safe.
What should be verified before access is granted?
Make the decision for the requested resource by considering the authenticated identity, the strength of authentication, the device’s current security posture, and relevant context or risk. This reflects NIST’s digital identity guidance and zero-trust approach: access is authorized to specific resources rather than assumed safe because a user is inside a network.
As an Amazon Associate I earn from qualifying purchases.
- Identity proofing establishes confidence in who is enrolling, using evidence collected and verified during onboarding.
- Authentication checks at access time that the claimant controls an authenticator enrolled to that identity. A successful login is not the same as proofing.
- Device posture supplies evidence about the endpoint, such as managed or compliant status and other organization-defined health or configuration signals.
- Authorization decides whether this identity, using this device and authentication method, may access this particular resource and privilege level.
NIST’s current digital identity guideline, SP 800-63-4, covers proofing, enrollment, authenticators, and federation. Its companion volumes address identity proofing and enrollment and authentication and authenticator management.
Recommended Free Tools
How to make the access decision
- Define identity proofing, enrollment, and recovery. Set how users establish their identity, how authenticators are issued, and how replacement, recovery, and revocation work. A weak recovery process can undermine otherwise strong login controls.
- Choose authentication strength for the resource. Match the authenticator and required assurance to the sensitivity and risk of the requested access. Require MFA where policy demands it, and consider phishing-resistant MFA for sensitive resources. NIST SP 800-63B-4 defines three authenticator assurance levels; use the applicable requirements rather than treating all MFA methods as equivalent.
- Evaluate device signals. Check the signals available in your environment, such as whether the device is managed and compliant, along with other policy-defined health or configuration evidence. Decide explicitly how to handle a signal that is missing, stale, or untrusted; do not silently treat absence of evidence as a healthy device.
- Authorize narrowly. Combine the verified identity, authentication strength, device evidence, resource sensitivity, and relevant context. Grant only the resource and privileges needed. If required evidence is absent or risk is too high, step up authentication, restrict access, or deny the request.
- Reevaluate the session. Set conditions for reauthentication, session or token revocation, or restriction when device posture changes, credentials are reported compromised, or risk changes. An initial check followed by a long session with no reevaluation can leave access in place after conditions have changed.
- Roll out carefully. Where the platform supports it, begin in report-only mode or with a limited pilot. Confirm sign-in, recovery, and emergency access procedures before broad enforcement. Exact controls and interface steps depend on the identity provider, device-management platform, and organizational policy.
How should identity and device evidence affect access?
Use policy to define what happens for each meaningful combination of evidence. A strong identity check does not compensate for an untrusted endpoint, and a compliant device does not establish who is using it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Evidence and request | Policy response |
|---|---|
| Required identity and authentication evidence is present; device meets the applicable policy; requested access is authorized | Grant only the resource and privileges requested. |
| Identity is established, but authentication strength is insufficient for the resource | Require an approved step-up authentication method or deny access. |
| Identity is authenticated, but the device is noncompliant or its required signal is missing or stale | Restrict, step up, or deny according to policy; do not assume the device is healthy. |
| Identity or device evidence changes during a session, or risk rises | Reevaluate access and, as policy requires, reauthenticate, restrict, or revoke the session. |
The exact response is a policy choice, not a universal vendor setting. NIST’s SP 1800-35 zero-trust practice guide describes example implementations and approaches to device health validation and ongoing risk assessment.
What to compare when selecting controls
Compare implementations against your threat model and operating environment rather than choosing a product based on one feature. Relevant criteria include:
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Resistance to phishing and credential theft.
- Identity proofing, enrollment, recovery, replacement, and revocation workflows.
- Quality and freshness of device-health signals.
- Support for managed, unmanaged, and mobile endpoints.
- Compatibility with applications, federation, and existing identity systems.
- Policy granularity and ability to reevaluate access during sessions.
- Accessibility for users and the operational effort required to support them.
- Auditability of decisions and the licensing or infrastructure the controls require.
NIST’s assurance standards address identity and authentication requirements; SP 1800-35 provides zero-trust architecture examples. Neither prescribes one vendor configuration for every organization.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →When is a smart-card reader relevant?
A PIV-compatible reader is appropriate only when an organization has selected PIV or a compatible smart-card credential. NIST’s SP 1800-12 PIV guide covers credentials used with integrated or external readers. Before obtaining a reader, verify that it works with the organization’s credential, operating system, and connector; a reader is not a general requirement for identity or device checks.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What a Microsoft-specific example can and cannot tell you
CISA’s Microsoft cloud security benchmark offers configuration guidance for its Microsoft environment, including managed-device requirements for MFA registration in the described control. It is an implementation example, not a universal standard; verify current product labels, licensing, and interfaces before applying it. The benchmark also reproduces an OMB M-22-09 direction: “When authorizing users to access resources, agencies must consider at least one device-level signal alongside identity information about the authenticated user.” That statement is directed at agencies and supports considering device evidence alongside identity; organizations outside that scope should follow their own applicable requirements.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
