How should organisations govern certificate lifecycle management for NIS2 and DORA?

Treat certificate lifecycle management as a governed identity process with named ownership, tracked inventory, renewal deadlines, and revocation evidence. The goal is to prevent expiry from becoming a resilience failure. For regulated services, align renewal, logging, and accountability so auditors can see control, not just configuration.

Why This Matters for Security Teams

For NIS2 and DORA, certificate lifecycle management is not a back-office hygiene task. It is part of service resilience, because expired or misissued certificates can halt customer-facing systems, interrupt privileged access, or break trust between services. Current guidance suggests treating certificates as governed machine identities, with ownership, renewal evidence, and revocation traceability tied to operational risk rather than isolated infrastructure admin work. That framing aligns with the NIST Cybersecurity Framework 2.0 and the EU’s resilience expectations in EU NIS2 Directive.

NHIMG research shows why this matters operationally: in The Critical Gaps in Machine Identity Management report, only 38% of organisations had automated certificate lifecycle management in place, and certificate expiry was the leading cause of outages for 45% of organisations. Those numbers point to a control gap, not a tooling gap alone. In practice, many security teams encounter certificate failures only after renewal misses or hidden dependencies have already caused service interruption.

How It Works in Practice

A defensible certificate lifecycle program starts with inventory, ownership, and policy. Every certificate should be tied to a business service, technical owner, issuing authority, expiry date, and revocation path. For regulated environments, the control objective is simple: prove that the organisation can discover, renew, replace, and revoke certificates before they become an outage or a trust failure. That evidence should be auditable across infrastructure, application, and third-party managed services. The NIS2 and DORA lenses both reward this kind of operational traceability.

Practitioners usually build the process around a few core mechanics:

• Maintain a complete certificate inventory, including internal CA, public CA, and embedded certificates.
• Assign named owners for renewal, incident response, and revocation decisions.
• Track expiry thresholds with escalation well before the final renewal window.
• Automate issuance and renewal where possible, but keep human approval for high-impact trust anchors.
• Log issuance, renewal, revocation, and failed renewal attempts as evidence for audit and operational review.

That structure is consistent with the lifecycle emphasis in NHI Lifecycle Management Guide and the risk patterns described in Ultimate Guide to NHIs — Regulatory and Audit Perspectives. It also maps cleanly to the OWASP Non-Human Identity Top 10, which treats weak ownership and lifecycle controls as recurring identity risk. Where this guidance breaks down is in organisations with many unmanaged certificates embedded in legacy appliances, because discovery and replacement often require maintenance windows that do not match business change cycles.

Common Variations and Edge Cases

Tighter certificate control often increases operational overhead, so organisations have to balance resilience against deployment speed and service autonomy. That tradeoff becomes sharper under DORA, where evidence of control matters, but false precision can slow critical changes if every certificate event is handled manually. Best practice is evolving toward automation for routine renewal and stronger governance only where business impact is material.

There are a few common edge cases. Short-lived certificates can reduce expiry risk, but they demand reliable automation and well-tested fallback paths. Shared platform certificates may simplify administration, yet they concentrate outage blast radius if ownership is unclear. Third-party and cloud-managed services can also create blind spots because renewal evidence may sit outside the organisation’s direct tooling. For that reason, current guidance suggests including vendors and managed service providers in the same inventory and assurance process used for internal certificates. The Guide to NHI Rotation Challenges is especially relevant when certificate replacement is coupled to broader identity rotation, while the Guide to the Secret Sprawl Challenge highlights why undocumented credentials and certificates often fail together. In regulated environments with legacy PKI, the hardest failures emerge when ownership is split across infrastructure, app teams, and external providers because no single team can prove end-to-end control.

Related resources from NHI Mgmt Group

• How should organisations govern PIV credentials across their lifecycle?
• How should organisations govern SaaS access as part of lifecycle management?
• How should institutions govern certificate lifecycle management in shared procurement models?
• How should teams govern certificate lifecycle management in multi-cloud environments?