Topic starter
25/06/2026 2:56 pm
TL;DR: Industrial and IoT environments need lifecycle management for device identity, certificates, and protected keys because remote maintenance, long device lifetimes, and heterogeneous brownfield and greenfield estates make conventional IT assumptions brittle, according to DigiCert. The control problem is not just security by design; it is sustained trust across onboarding, operations, updates, and retirement.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “How Technology is Transforming Industries in the Digital Era”.
Key questions
Q: What breaks when industrial device identity is managed as a one-time setup task?
A: The control breaks at renewal, maintenance, and retirement.
Q: Why do long-lived OT devices need certificate and key lifecycle governance?
A: Because service lives of 15 to 30 years create far more exposure to stale credentials, lost custody, and outdated trust assumptions than standard IT endpoints do.
Q: How should teams govern remote maintenance access for industrial devices?
A: Treat OEM maintenance as a controlled identity relationship, not a convenience channel.
Practitioner guidance
- Define device identity ownership across the full lifecycle Assign clear accountability for device identity, certificate renewal, key custody, and retirement across OEMs, operators, and internal security teams.
- Separate onboarding identity from operational network identity Use a stable, authoritative device identifier before production use, then map operational attributes separately for monitoring and access decisions.
- Standardise certificate and key handling for headless devices Require protected key storage on device, explicit certificate renewal workflows, and revocation paths that still work when the device is offline or constrained.
Bottom line: Industrial device identity fails when teams treat onboarding as the whole problem instead of governing trust through operations, updates, and retirement.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:11 pm
Device identity in OT is a lifecycle governance problem, not a provisioning problem. The article’s central insight is that industrial devices live too long, update too slowly, and operate too close to production constraints for one-time identity setup to be enough. Onboarding, maintenance, certificate renewal, and retirement all become part of the trust boundary. Practitioners should read this as a lifecycle mandate, not a deployment checklist.
A question worth separating out:
Q: What is the difference between device identity in OT and user identity in IT?
A: User identity relies on interactive authentication and shorter access cycles, while device identity depends on cryptographic proof, local key protection, and long-lived operational trust. OT devices are also constrained by uptime, patch windows, and interoperability, which makes lifecycle governance much more demanding.
👉 Read our full editorial: Industrial device identity needs lifecycle governance, not point fixes