Count primary/recovery authenticators, stock and enrollment effort under an explicit rollout policy.
Security
Security key rollout and recovery inventory
Count primary/recovery authenticators, stock and enrollment effort under an explicit rollout policy.
Example inputs · Replace these with your measurements to build your plan.
Method, example and sources
Multiply people by the selected number of registered authenticators.
Add a separately chosen unassigned-stock allowance and subtract usable stock on hand.
Multiply registrations by measured enrollment time and divide by explicit staffing capacity.
Review exact platform support and test loss, revocation and replacement; stock is not automatically a recovery credential.
Worked example. One hundred people with two registered keys each require 200 assigned keys. A chosen 10% unassigned-stock target adds 20; with 20 usable keys held, acquire 200. Five minutes per registration is about 16.67 staff-hours.
The policy and enrollment time are entered assumptions; neither quantity nor a connector label proves platform support.
Keys assigned for registration
200
Unassigned spare stock target
20
New keys to acquire
200
Enrollment labor
16.667staff-hours
Ideal staffed days
1.389days
Security key rollout and recovery inventory: detailed result
Readiness check
State
Exact platform support
Unknown
Tested loss/revocation procedure
Needs a tested recovery procedure
Spare registration
Unassigned stock is not a registered recovery credential
The per-person count is a chosen policy, not a universal platform requirement. Confirm supported interfaces, attestation policy, resident credentials and firmware.
Labor excludes procurement, scheduling, identity proofing, application-specific registration and recovery work unless included in the measured input.
From the catalog
Hardware authenticators
Explore related listings, then confirm the exact model requirements against your plan. These listings are not an automatic compatibility or capacity verdict.
Use the catalog search inside the worksheet to choose a model or compare the full product family.
Rollout inventory should distinguish a registered recovery authenticator from an unused spare in a cupboard. The former already belongs to an account; the latter still needs a supported enrollment and identity-verification process. This worksheet makes that policy explicit and counts the staffing effort using measured registration time rather than claiming one universal keys-per-person requirement.
Before choosing a product
Exact platform, application, interface, firmware and attestation policy can change which authenticators are accepted. Test primary sign-in, a lost key, revocation and a replacement before a broad rollout. An inventory total cannot certify phishing resistance for every application or establish a compliance outcome. Keep enrollment labor, scheduling, support and recovery work visible when preparing the deployment scope and product requirements.
Worked example
One hundred people with two registered keys each require 200 assigned keys. A chosen 10% unassigned-stock target adds 20; with 20 usable keys held, acquire 200. Five minutes per registration is about 16.67 staff-hours.
Security key rollout and recovery inventory — Uniqcli
