Topic starter
12/07/2026 12:16 pm
TL;DR: Certificate lifecycle management now sits inside regulated identity governance under NIS2 and DORA, according to eMudhra. Hybrid and supplier certificate estates need continuous inventory, renewal, and retirement to keep trust and auditability intact.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “NIS2 and DORA Compliance: How PKI and CLM Help European Enterprises Stay Compliant”.
Key questions
Q: Why do certificates create regulatory risk in financial and critical infrastructure environments?
A: Because they are the identity and trust substrate for encrypted communications, code signing, and authenticated system-to-system access.
Q: How do teams know whether certificate governance is actually working?
A: Look for three signals: clean issuance records, consistent revocation propagation, and matching status across PKI, endpoint security, and operations.
Q: What breaks when certificate lifecycle governance is missing under NIS2 and DORA?
A: Expiry, orphaning, and untracked renewals turn certificates from trusted machine credentials into operational liabilities.
Practitioner guidance
- Map every certificate estate Build a complete inventory across servers, APIs, load balancers, containers, IoT devices, code repositories, and third-party services.
- Assign renewal ownership Attach a named owner and renewal deadline to each certificate, including vendor-managed certificates that support critical flows.
- Separate internal and supplier trust domains Document which certificates are controlled internally and which depend on external parties, then require supplier evidence for renewal, revocation, and CA chain integrity.
Bottom line: NIS2 and DORA move certificate management into the regulated identity control plane, where lifecycle discipline matters as much as cryptographic strength.
Glossary terms: Certificate Lifecycle Management, Mutual Tls, Public Key Infrastructure, Third-Party ICT Risk Oversight
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
12/07/2026 12:30 pm
Certificate lifecycle governance is now a regulatory control, not an operational preference. NIS2 and DORA both force enterprises to prove that certificate trust is continuously managed across issuance, renewal, and retirement. That changes PKI from a back-office function into part of the regulated identity control set. The practitioner conclusion is straightforward: if certificates cannot be governed, the underlying compliance story is incomplete.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What role should third-party certificates play in supplier risk reviews?
A: They should be treated as part of the supplier’s operational trust posture, not as a narrow technical detail. If a vendor certificate can break a regulated service or interrupt authenticated traffic, its lifecycle belongs in supplier due diligence, renewal coordination, and resilience oversight.
👉 Read our full editorial: NIS2 and DORA make certificate lifecycle governance unavoidable