Your offboarding checklist covers the badge, the laptop, and the VPN account. It probably doesn't cover the FIDO2 passkey still registered in your identity provider under the name of the person who left six weeks ago.
That registration is still valid. If the token went home in a bag rather than back to IT — and your data says it probably did — you have an active authentication credential attached to a terminated identity. That is not a theoretical risk. It is a persistence mechanism, and it does not require any technical sophistication to exploit.
Vol. 14 of Zero Assumptions examines token lifecycle governance: the operational discipline that determines whether your hardware security investment is actually producing security, or just producing a sense of security.
The Phase That Kills You Is Phase 3
Token lifecycle has three phases. Most organisations handle Phase 1 (provisioning) adequately. Phase 2 (active use and role change) is where drift begins. Phase 3 — decommissioning — is where most programmes fail completely.
The failure pattern is consistent: the physical token comes back (sometimes), but the credential registration in the identity provider is never removed. The HR ticket closes. The IT batch job runs next Tuesday. The window between termination and revocation is unmeasured, unmonitored, and in many cases unlimited.
Verizon DBIR data suggests 34% of identity-related breaches involve credentials that should have been revoked. This is the mechanism.
Four Failure Patterns Worth Naming
- The Ghost Credential: FIDO2 registration persists in the IdP after offboarding. Token is still valid. Former employee may still have it.
- The Role Drift Token: Token provisioned for a junior analyst now authenticates an admin. Same key, dramatically expanded permissions, no re-evaluation.
- The Untracked Spare: Three keys from the batch of 50 were kept as spares. Never entered the asset register. Cannot be audited or invalidated.
- The Informal Handoff: Token left on a colleague's desk. Credential still bound to the original owner. No audit trail. No security.
The Five Controls That Close the Gap
Token lifecycle governance is a policy architecture, not a product. It requires five specific controls, each generating the audit evidence your NIS2 Article 21(2)(i) compliance posture requires:
- Centralised token registry — every key tracked by serial number, user, privilege tier, and expected return date
- Credential binding tied to access review — FIDO2 and PIV credentials re-validated when roles change, not only at offboarding
- Zero-day decommissioning SLA — credential revocation within two hours of offboarding initiation, before the session ends
- Physical chain of custody — documented possession history for every device; hardware binding makes informal handoff cryptographically visible
- Annual lifecycle attestation — every token physically reconciled once per year; discrepancies trigger immediate investigation; the report is your NIS2 audit evidence
NeoWave Winkeo-C — ANSSI-Certified, CC EAL6+
Lifecycle governance requires that your hardware choice supports governance — not just authentication. The NeoWave Winkeo-C is manufactured in France with full European supply chain transparency, and its ANSSI Visa de Sécurité provides the independent third-party validation that belongs in a NIS2 audit file. The CC EAL6+ secure element ensures that credentials cannot be extracted from a returned token — decommissioning produces a clean cryptographic break.
- CC EAL6+ secure element — credentials non-extractable; returned token is cryptographically clean
- ANSSI Visa de Sécurité — independent audit certification, directly usable as NIS2 evidence
- Made in France — full EU supply chain sovereignty, supports NIS2 Art. 21(2)(i) supply chain attestation
- FIDO2 / WebAuthn / U2F — works with EntraID, Okta, Google Workspace
Order 50+ units and unlock automatic volume pricing — buffer stock in a governed asset register, not loose in a drawer.
Feitian BioPass K49 — CC EAL6+, FIPS 140-3 Level 3
The Feitian BioPass K49 addresses one of the most persistent lifecycle failure modes directly: the informal handoff. On-device fingerprint matching inside a CC EAL6+ secure element means the credential is biometrically bound to the enrolled user. You cannot hand this key to a colleague and have it work under your identity. The informal handoff failure pattern is cryptographically blocked by design.
- CC EAL6+ secure element — private keys generated on-device, never exported, non-recoverable on decommissioning
- FIPS 140-3 Level 3 — US federal standard, directly usable as compliance evidence
- On-device biometric matching — credential is personally bound; informal handoff is cryptographically blocked
- FIDO2 / PIV / OATH / OpenPGP — multi-protocol for diverse enterprise environments
- Post-quantum firmware architecture — credential binding designed to survive algorithm transitions
Best per-unit pricing applied automatically at 50 pieces.
What Good Lifecycle Governance Produces
A well-governed lifecycle programme generates its own audit evidence as a by-product of normal operations. The asset register provides the inventory. The provisioning logs provide the access-grant documentation. The decommissioning SLA log provides the revocation evidence. The annual attestation provides the periodic review record.
When an auditor requests NIS2 Article 21(2)(i) evidence, you are not assembling documents under pressure — you are pulling reports from a system that has been running continuously. That is the difference between a lifecycle programme that exists on paper and one that actually closes the gap.
The tokens you cannot account for are the ones that will appear in your post-incident report.
Mikael Rodin
Managing Director, Ciptor AB
P.S. Vol. 15 closes Pillar 3 with Physical Access Convergence — the architecture for organisations moving to unified logical and physical access on a single hardware token.
