Notifications
Clear all
Topic starter
12/07/2026 12:20 pm
TL;DR: PIV cards extend PKI into a standardized, phishing-resistant credential for physical and logical access, combining certificates, PINs, and biometrics under FIPS 201 for federal agencies and contractors, according to Versasec. The operational question is not whether cryptographic identity is stronger, but whether credential lifecycle governance can keep pace across smart cards, derived credentials, and cloud-era access.
NHIMG editorial — based on content published by Versasec: PIV Cards: From PKI to Modern Identity
By the numbers:
- PIV standards were created by the U.S. federal government under FIPS 201 and are mandatory across federal agencies and federal contractors.
- FIPS 201-3 expanded support for derived credentials as mobile and remote work increased.
Questions worth separating out
Q: How should organisations govern PIV credentials across their lifecycle?
A: Organisations should treat PIV lifecycle management as an identity governance process, not a card-issuance task.
Q: Why do PIV cards still matter in Zero Trust programmes?
A: PIV cards still matter because Zero Trust depends on strong, phishing-resistant identity at the point of access.
Q: What breaks when organisations treat PIV as only an authentication factor?
A: What breaks is the governance model behind the credential.
Practitioner guidance
- Audit credential lifecycle ownership Identify which team owns issuance, renewal, revocation, and exception handling for PIV or PIV-like credentials.
- Separate assurance from form factor Assess whether the security standard is being met by the credential itself or by the controls around it, including proofing, binding, and revocation.
- Map PIV to Zero Trust entry points Use PIV at the access points where phishing resistance matters most, such as remote workforce login, privileged administration, and regulated facility access.
What's in the full article
Versasec's full article covers the operational detail this post intentionally leaves for the source:
- Credential management system workflow for issuing, renewing, and revoking PIV and derived credentials.
- Practical distinctions between PIV, PIV-I, PIV-D, CIV, and CAC deployment models.
- How smart card credentials map to modern passwordless and Zero Trust programmes.
- The vendor’s view of enterprise credential orchestration across physical and logical access.
👉 Read Versasec's analysis of PIV cards, PKI, and modern identity governance →
PIV cards and PKI trust: what identity teams need now?
Explore further
12/07/2026 12:34 pm
PIV cards matter because they make phishing-resistant identity operational, not theoretical. The article is right to frame PIV as the evolution of PKI into a full identity ecosystem rather than a single factor. That matters because certificates alone do not solve governance, but PIV ties proofing, issuance, and use to a standardised credential model. Practitioners should view this as a model for how stronger identity assurance becomes usable at scale.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which helps explain why lifecycle governance often lags behind issuance controls.
A question worth separating out:
Q: What should IAM teams evaluate before adopting derived credentials?
A: IAM teams should evaluate whether derived credentials preserve the same assurance, auditability, and revocation behaviour as the source PIV credential. They also need to confirm how mobile and remote use will interact with device trust, access policy, and recovery processes. Convenience is useful only when governance stays intact.
👉 Read our full editorial: PIV cards and modern identity: why PKI still matters
