Topic starter
25/06/2026 12:15 am
TL;DR: IoT devices now operate inside business and public service chains with little transparency into who or what is talking to whom, and the article argues that unique device identity, standardized certificates, and conformity checks are becoming necessary foundations for security and privacy, according to DigiCert. The governance question is no longer whether connected devices need identity, but whether organisations can treat ephemeral device trust as a regulated control surface.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “Guest Opinion: IoT Devices Need Greater Conformity and Security Built In”.
Key questions
Q: How should security teams govern IoT device identity across service chains?
A: Treat each device as a managed identity with an owner, purpose, assurance level, and lifecycle state.
Q: Why do standardized certificates matter for connected device security?
A: Certificates give devices a consistent way to prove identity to systems that depend on them.
Q: When should organisations prefer ephemeral identity over long-lived credentials?
A: Organisations should prefer ephemeral identity when the workload can authenticate itself at runtime and the business does not need a reusable secret to operate.
Practitioner guidance
- Define device identity as a governed trust object Create an inventory and assurance model that treats each IoT device as a distinct identity with an owner, purpose, and lifecycle state.
- Adopt certificate-backed authentication for device trust Require standardized digital certificates for device-to-service authentication so communications can be verified before access is granted.
- Separate verification from persistence Use ephemeral or disposable identifiers where possible so the device can be trusted without enabling long-term tracking of the device or its owner.
Bottom line: IoT device identity is becoming a core control surface because connected devices now participate in service chains where trust cannot be left implicit.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:08 am
Device identity is no longer an asset-management detail, it is a security control plane. Once devices move into homes, roads, hospitals, and city services, the question is not whether they exist but whether they can be governed as trusted participants in a service chain. That shifts the control problem from simple inventory to identity-backed trust establishment. Practitioners should treat device identity as part of the security architecture, not as a label on top of it.
A question worth separating out:
Q: What should procurement teams require before an IoT device enters production?
A: They should require identity assurance, certificate support, and conformity testing as part of onboarding, not after deployment. That means the device is validated as part of the supply and acceptance process, so security controls exist before the device begins interacting with people, systems, or services.
👉 Read our full editorial: IoT device identity and certificates are becoming security infrastructure