Topic starter
11/07/2026 8:27 pm
TL;DR: Credential governance must keep pace across certificate, smart card, and badge lifecycles, according to Versasec’s Summer Series 2025. The series frames vSEC:CMS as a way to manage PKI, FIDO2, and physical access credentials from one platform, while citing more than 500 customers and average retention of 95 months.
Editorial analysis by NHI Mgmt Group, based on content published by Versasec: “vSEC:CMS Summer Series 2025: Unifying PKI, FIDO2, and Physical Access”.
Key questions
Q: How should teams govern PKI, FIDO2 and physical access credentials together?
A: Treat them as one credential estate with different control requirements, not as separate administration problems.
Q: Why do separate badge, certificate and authenticator workflows create governance risk?
A: Because each workflow can preserve access independently after the identity has changed.
Q: What are the signs that credential lifecycle governance is fragmented?
A: Common signs include duplicate offboarding steps, manual recovery requests, different renewal cadences and unclear ownership between IAM, PKI and facilities teams.
Practitioner guidance
- Define a single credential ownership model Map PKI, FIDO2 and physical access credentials to named owners, authoritative sources and revocation paths so every credential type has clear lifecycle accountability.
- Reconcile offboarding across credential types Test whether certificate revocation, badge deactivation and authenticator recovery are triggered together when a user changes role or leaves.
- Separate authentication strength from lifecycle control Assess FIDO2 and PKI programmes on issuance, recovery, rebind and retirement controls, not only on phishing resistance or cryptographic strength.
Bottom line: Unified credential management matters because lifecycle fragmentation creates inconsistent access states across certificates, authenticators and badges.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:56 pm
Unified credential governance is becoming a lifecycle problem, not a technology problem. Once certificates, FIDO2 authenticators and physical access badges are managed in separate tools, organisations inherit different offboarding rules, different recovery paths and different audit states. That fragmentation is the real control gap, because entitlement consistency is what determines whether access is actually current. Practitioners should evaluate the lifecycle boundary, not just the authentication method.
A few things that frame the scale:
- According to the 2023 State of Machine Identity Management report, only 47% of companies have enough staff dedicated to their PKI.
A question worth separating out:
Q: What should organisations do if physical access badges are outside IAM control?
A: Bring physical access into the same governance model even if the operational system stays separate. At minimum, align badge issuance, deactivation, exception approval and review evidence with identity records so badge access does not outlive digital access state. That keeps the identity lifecycle coherent across buildings and systems.
👉 Read our full editorial: Unifying PKI, FIDO2, and physical access credentials