Passkey Rollout Scorecard

Instructions

Complete this scorecard before your first passkey enrollment prompt goes live. For each area, assess whether your organization is ready, partially ready, or not ready. Use the gaps to adjust your rollout plan and timeline.

1. User Segmentation

• First rollout group identified (admins, security team, executives, or similar high-value targets)
• User groups defined with different passkey models (synced, device-bound, hardware key)
• Contractors and BYOD users addressed separately
• Shared-device workflows identified and planned for
• Privileged users have stricter authentication requirements than general workforce

2. Device and Browser Readiness

• Managed device inventory completed (Windows, macOS, iOS, Android)
• Browser versions audited for passkey support
• Platform authenticator vs. roaming security key decision documented per device type
• Unmanaged and shared devices have explicit policy (allowed, restricted, or blocked)
• Cross-device sign-in patterns understood and tested

3. Recovery and Fallback Design

• Lost-device recovery process documented and tested
• Backup method required during enrollment (second passkey, security key, or bootstrap credential)
• Identity verification steps defined for re-registration
• Privileged account recovery has stricter controls than standard workforce
• Temporary fallback methods have expiration dates
• Social engineering protections in place for help desk recovery

4. Support Readiness

• Help desk trained on common passkey scenarios (new device, lost phone, wrong prompt)
• Support scripts documented for top five enrollment and recovery cases
• Escalation path defined for privileged account issues
• Support team included in pilot group
• Help desk ticket categories created for passkey-specific issues

5. Policy and Enforcement

• Phased enforcement stages defined (optional, required enrollment, required use, weak method removal)
• Conditional access or authentication strength policies configured
• Weak fallback methods (SMS, voice, push) have planned removal dates
• Break-glass accounts have separate, documented controls
• Apps included in phase one are already federated through SSO

6. Metrics and Success Criteria

• Enrollment rate target defined per user group
• Login success baseline measured before rollout
• Fallback usage tracking in place
• Help desk volume monitoring configured
• Go/no-go thresholds defined for expanding to next phase

Readiness Summary

Area	Status (Ready / Partial / Not Ready)	Biggest Gap	Owner	Target Date
User Segmentation
Device & Browser
Recovery & Fallback
Support Readiness
Policy & Enforcement
Metrics & Success