Delivery
- The card is delivered with the desired policies and configuration set and with no fingerprints enrolled.
Personalisation
- Card printing is complete
- Credentials are written to the card
- (DESFire) the required DESFire AIDs are biometrically registered
Active
- Fingerprints enrolled on card
- Credentials are given permissions in the access control system
- (FIDO) passkeys are registered with services
Revocation
- Credential permissions are revoked in the access control system
- Fingerprints can be deleted from card
- (FIDO) the passkey must be removed from each service, by the user or the service administrator
- (FIDO) resetting FIDO on the card wipes every passkey from the card itself
Re-issuance
- Credentials are given new permissions in the access control system
- New fingerprints enrolled on the card
- (FIDO) passkeys are registered with services
Retired
- Card is physically destroyed
- Permissions are removed from the accounts and the access control system
See: Rolling out cards across your organisation, Encoding DESFire credentials on IDEX cards and Lost or stolen card: revoke and replace.