Notifications
Clear all
Topic starter
11/07/2026 8:30 pm
TL;DR: A national Ministry of Defence in Asia Pacific is modernising outdated PKI, credential management, and end-user device controls to support FIPS 201 PIV, biometric match-on-card, and multi-environment resilience, according to Intercede. The case shows that identity refresh programmes fail when they treat device, credential, and key storage as separate problems rather than one governance boundary.
NHIMG editorial — based on content published by Intercede: Modernising digital identity for national defence
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: How should security teams modernise legacy PKI without breaking identity trust?
A: They should treat PKI migration as a trust-chain programme, not a certificate swap.
Q: Why do biometrics need to stay within the credential boundary?
A: Keeping biometrics inside the credential boundary reduces exposure of templates and preserves the link between the person, the device, and the credential.
Q: What should organisations review before introducing secure key storage into an IAM programme?
A: They should review who can generate, recover, and revoke key material, how dependencies on a certificate authority are handled, and what happens during migration or outage.
Practitioner guidance
- Map the full identity trust chain before replacing legacy infrastructure Inventory PKI, credential management, biometric binding, key storage, and device dependencies as one change boundary so you can see where cutover risk will concentrate.
- Separate biometric assurance from transport and storage layers Keep biometric match-on-card or equivalent controls tied to the credential boundary so sensitive templates do not become widely replicated identity data.
- Design key recovery and reissue as formal governance processes Document who can recover, reissue, and revoke sensitive key material, and make those authorities auditable across each environment.
What's in the full article
Intercede's full case study covers the implementation detail this post intentionally leaves for the source:
- The integration sequence for MyID CMS, MyID SecureVault, and the new PKI component across separate environments.
- The deployment constraints that shaped the phased rollout and the December 2026 completion target.
- The device and smartcard options considered, including future support for mobile platforms, USB tokens, and virtual smartcards.
- The operational specifics behind secure biometric storage and CA-independent key recovery.
👉 Read Intercede's case study on defence digital identity modernisation →
Defence digital identity modernisation: what changes for IAM teams?
Explore further
11/07/2026 9:00 pm
Identity modernisation in defence is a governance problem, not a hardware refresh. This case study shows that PKI, credential management, biometrics, and device trust all had to move together because end-of-life infrastructure creates overlapping risk. The lesson for identity teams is that resilience depends on managing the full trust chain, not just replacing one component.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: How do phased identity rollouts reduce risk in regulated environments?
A: Phased rollout limits the blast radius of change and makes control failures easier to isolate. Separate environments can reveal hidden dependencies, such as biometric storage needs or device compatibility issues, before full production expansion. That approach supports continuity, but only if rollback and governance are planned with the same rigour as deployment.
👉 Read our full editorial: Modernising defence digital identity infrastructure for long-term resilience
