Topic starter
09/07/2026 3:29 pm
TL;DR: The CSPN application has been formally submitted to ANSSI after a pre-evaluation with Quarkslab, with the process now moving into review of the Security Target, supporting documentation, cryptographic design, and resistance to realistic attack scenarios, according to PassBolt. That matters because certification processes test whether a product’s security claims survive independent scrutiny, not just whether controls exist on paper.
Editorial analysis by NHI Mgmt Group, based on content published by PassBolt: “Passbolt enters the CSPN certification process”.
Key questions
Q: What should teams look for in a credential governance certification review?
A: Teams should look for evidence that the review covers cryptographic design, installation procedures, documentation, threat assumptions, and the scope of the security guarantees.
Q: Why is an independent assessment more useful than a feature list for credential tools?
A: A feature list says what a product can do, but an independent assessment shows whether those claims hold under defined assumptions and realistic attack scenarios.
Q: How should organisations evaluate security assumptions in credential platforms?
A: They should identify the assumptions that underpin the product’s guarantees, then test whether those assumptions are still true in their environment.
Practitioner guidance
- Map assurance claims to deployment assumptions Document which security guarantees depend on specific installation choices, operator behaviours, or trust boundaries before approving a credential platform.
- Review cryptography and operations together Ask for the cryptographic design, the administration guide, and the threat model as a single evidence set instead of treating them separately.
- Use certification evidence in procurement decisions Require vendors to show what the certification process actually tests, including realistic attack scenarios and the exact scope of review.
Bottom line: Credential governance products need independent scrutiny because security claims only matter when they survive review of design, documentation, and deployment assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:49 pm
Certification shifts credential governance from assertion to evidence: In security-critical identity tooling, claims about protection are only useful when they survive independent review. CSPN forces the vendor to prove how cryptography, deployment, documentation, and assumptions fit together. That changes procurement from trust in product messaging to trust in verifiable assurance.
A question worth separating out:
Q: What does certification tell buyers about deployment readiness?
A: Certification can indicate that the product has been examined against a defined security target and realistic attack scenarios, but it does not remove the need for local validation. Buyers still need to confirm that their own installation, administration, and integration model matches the assumptions used in the evaluation.
👉 Read our full editorial: Passbolt’s CSPN submission and what it means for credential governance