Much like Google in recent years, Apple has added two-step verification for Apple ID and iCloud. This process consists of a failsafe security measure, which comes in the form of a four-number code received on your iPhone or "Find My Phone" App, which then verifies that you are the owner of the iCloud or Apple ID account.
In the case of a lost phone or password, there is a recovery key which is given for safekeeping. This key can then be used to override the two step verification and either disable the security measure or reset a password. Apple advises that the key should not be kept on your iPhone, which naturally would be a rather unhandy place if you lose your iPhone and need the key.
We have personally tested the security measure and, after having to try twice to get our iPhone verified, found that the system has some unfortunate bugs, which could make regular use of the security layer more annoying than helpful. For one, we found a significant delay in requesting and receiving the code, which resulted in a key time out. Apple has yet to take into account the delays encountered by users and carriers, but hopefully, the system will be more streamlined soon. More on this can be found on Apple's website here.