Emma Zaman Strategic Advisor: Sovereign Identity & Compliance

Your vendor passed the audit. Their contractor didn't. And that's the door attackers walked through.

Zero Assumptions · Vol. 12 of 25 · Pillar 3: Hardware Root of Trust

Last week we talked about what's inside the chip. This week is about who carries it through your door.

One in three security incidents doesn't start with a phishing email sent to your employees. It starts with a valid login — from a trusted third party whose credentials were never held to the same standard as your own. A supplier. An IT contractor. A managed service provider connecting to your environment every Tuesday morning to run patching cycles.

They passed your vendor assessment. They signed your security policy. And their access was provisioned with a password and an SMS code — because requiring a hardware key felt like too much friction for an external partner.

The Assumption

If our internal identities are secured with phishing-resistant hardware authentication, our external business systems are protected.

The Reality

NIS2 Article 21 places explicit supply chain risk management obligations on essential and important entities — precisely because threat actors know that the perimeter is strongest where you're looking, and weakest where you're not. Third-party access is where your security standards and theirs meet. If that meeting point is a reusable password, it is the most exposed credential in your entire environment.

According to the 2025 Verizon Data Breach Investigations Report, 15% of all breaches now involve a third party — up from 9% the prior year. The vector isn't exotic. It's a contractor logging in with credentials that have no hardware binding, no device check, and no step-up trigger.

The Blueprint

Enforce the same phishing-resistant hardware standard across all external parties with persistent access to your environment. This is not about treating suppliers as adversaries. It is about acknowledging that your security posture is only as strong as the weakest credential touching your systems — and making sure that credential is a hardware-bound key, not a password.

Practically, this means three things:

• Classify external access by risk level — any party with persistent, privileged, or unmonitored access to your environment should be in scope for hardware key requirements
• Provision, not request — if you supply the key to your contractor, you control the credential and the standard. Asking them to use their own is asking them to make your security decision for you
• Include supply chain authentication in your NIS2 audit evidence — regulators are actively asking whether third-party access is covered by the same controls as internal users. A gap here is a gap in your Article 21 submission

NeoWave & Feitian: The Keys You Provision to Partners

When you provision hardware keys to external partners, you need a standard they can actually use — on any device, any OS, any browser — without requiring your IT team to manage their endpoints.

NeoWave Winkeo-C FIDO2 — ANSSI Security Visa, CC EAL6+ secure element, manufactured in France. Sovereign supply chain documentation available for NIS2 Article 21 audit submissions. Supports FIDO2 and PIV. When you need to prove to a regulator that the hardware in your supply chain has been independently certified by an EU authority, this is the key that comes with the paperwork.

Feitian BioPass K49 — CC EAL6+ on the FT-JCOS platform, biometric fingerprint match inside the secure element, FIPS 140-3 Level 3, PQC-ready. For contractors who handle privileged access — server environments, network infrastructure, financial systems — the biometric binding ensures the key can only be used by the person it was provisioned to. It cannot be shared, lent, or handed off.

Ciptor supplies both keys in contractor provisioning bundles — with central lifecycle management so you can revoke access the moment an engagement ends, without waiting for the contractor to return a device.

Talk to us about supply chain provisioning

Next week: Vol. 13 — Biometric Spoofing Realities. The difference between a fingerprint reader on a device and a biometric match inside a secure element.

Mikael Rodin

Managing Director, Ciptor AB

P.S. If you're mapping your NIS2 Article 21 supply chain controls and need to know what hardware evidence regulators are asking for, reply to this email. We've sat in those audit rooms.