Key Changes on Authentication Front:

•Added definition and requirements for phishing resistant authenticators.

•Reference to OMB 22-09 Zero-Trust requirements for phishing resistant authenticators.

•Updated biometric performance requirements and metrics.

•Guidance for addressing equity impacts.

•Additional guidance for account recovery options, including subscribers with limited access to multiple authenticators.

•Guidance and requirements for activation secrets used by authenticators to access a stored secret key used for authentication.

•Guidance and requirements for use of wireless (Bluetooth, NFC) connections between the authenticator and endpoint for cryptographic authentication.