Topic starter
12/07/2026 12:16 pm
TL;DR: NIS2 and DORA now push certificate lifecycle management from infrastructure hygiene into regulatory control, because encrypted communications, mutual authentication, audit trails, and third-party trust all depend on governed PKI according to eMudhra. The compliance gap is not the presence of certificates but the inability to inventory, renew, and retire them continuously across hybrid and vendor ecosystems.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “NIS2 and DORA Compliance: How PKI and CLM Help European Enterprises Stay Compliant”.
Key questions
Q: What breaks when certificate lifecycle governance is missing under NIS2 and DORA?
A: Expiry, orphaning, and untracked renewals turn certificates from trusted machine credentials into operational liabilities.
Q: Why do certificates create regulatory risk in financial and critical infrastructure environments?
A: Because they are the identity and trust substrate for encrypted communications, code signing, and authenticated system-to-system access.
Q: How do teams know whether certificate governance is actually working?
A: Look for three signals: clean issuance records, consistent revocation propagation, and matching status across PKI, endpoint security, and operations.
Practitioner guidance
- Map every certificate estate Build a complete inventory across servers, APIs, load balancers, containers, IoT devices, code repositories, and third-party services.
- Assign renewal ownership Attach a named owner and renewal deadline to each certificate, including vendor-managed certificates that support critical flows.
- Separate internal and supplier trust domains Document which certificates are controlled internally and which depend on external parties, then require supplier evidence for renewal, revocation, and CA chain integrity.
Bottom line: NIS2 and DORA move certificate management into the regulated identity control plane, where lifecycle discipline matters as much as cryptographic strength.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:30 pm
Certificate lifecycle governance is now a regulatory control, not an operational preference. NIS2 and DORA both force enterprises to prove that certificate trust is continuously managed across issuance, renewal, and retirement. That changes PKI from a back-office function into part of the regulated identity control set. The practitioner conclusion is straightforward: if certificates cannot be governed, the underlying compliance story is incomplete.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What role should third-party certificates play in supplier risk reviews?
A: They should be treated as part of the supplier’s operational trust posture, not as a narrow technical detail. If a vendor certificate can break a regulated service or interrupt authenticated traffic, its lifecycle belongs in supplier due diligence, renewal coordination, and resilience oversight.
👉 Read our full editorial: NIS2 and DORA make certificate lifecycle governance unavoidable