How do security teams decide whether to centralise FIDO2, PKI, and physical access credentials in one workflow?

Why This Matters for Security Teams

Centralising FIDO2, PKI, and physical access credentials is not just an administrative choice. It changes how identity, access, and revocation are governed across buildings, devices, and user populations. The practical question is whether one workflow improves control without creating a brittle dependency that slows enrolment, recovery, or emergency access. NIST’s NIST SP 800-63 Digital Identity Guidelines and NIST SP 800-53 Rev 5 Security and Privacy Controls both reinforce that identity proofing, authentication, and lifecycle controls must be consistent, but they do not require one monolithic workflow for every credential type.

For security teams, the risk is usually not technical impossibility but operational drift: duplicated approvals, inconsistent revocation, and fragmented audit trails that weaken assurance. The Ultimate Guide to NHIs — Static vs Dynamic Secrets highlights why lifecycle discipline matters, while NHIMG research shows that only 1.5 out of 10 organisations are highly confident in securing NHIs. That confidence gap matters here because credential workflows often fail at the boundaries between IT, physical security, and compliance. In practice, many security teams discover the weakness only after revocation fails across one system while the others still trust the same user.

How It Works in Practice

A unified workflow is strongest when the organisation wants one source of truth for identity proofing, approval, issuance, suspension, and audit. That usually means a common identity platform feeds separate enforcement points: FIDO2 authenticators for digital access, PKI certificates for device or service trust, and badge systems for physical entry. The goal is not to make every credential identical, but to normalise the governance steps around them.

Operationally, teams should decide whether the workflow centralises policy, issuance, or both. Many mature programmes centralise policy while allowing different technical back ends. For example, a single joiner-mover-leaver process can trigger FIDO2 registration, certificate issuance, and badge provisioning, then route revocation through one orchestration layer. That approach reduces exceptions and improves evidence collection for audits. It also aligns well with OWASP Non-Human Identity Top 10 thinking about lifecycle control, because credential sprawl is often a process problem before it becomes a technology problem.

NHIMG’s Guide to the Secret Sprawl Challenge is relevant here because the same failure pattern appears when credentials are issued in different systems with no unified revocation path. If a badge is deactivated in one console but the PKI certificate remains valid, security is only partial. Best practice is evolving toward a central policy engine with tightly integrated downstream systems rather than one oversized manual workflow.

• Centralise when the same identity proofing and approval logic applies to all three credential types.
• Separate workflows when physical access has site-specific rules that digital credentials do not share.
• Use shared revocation triggers so termination removes all active trust relationships at once.
• Keep audit evidence consistent across HR, IAM, PKI, and physical security systems.

These controls tend to break down in multi-jurisdiction environments with legacy badge systems and certificate authorities that cannot support event-driven revocation.

Common Variations and Edge Cases

Tighter centralisation often increases administrative overhead, requiring organisations to balance stronger governance against local flexibility and emergency response needs. That tradeoff is most visible in sites with different legal requirements, union rules, contractor access, or safety-critical physical areas. In those cases, current guidance suggests centralising the approval and audit model while preserving local exception handling for physical access only where necessary.

There is no universal standard for this yet. Some organisations centralise all issuance into one workflow because it simplifies compliance and reduces duplicated identity checks. Others keep FIDO2 and PKI under one security function while leaving physical access with facilities teams, then synchronise revocation through shared identity events. The right answer depends on whether the organisation can maintain a single authoritative identity record and whether downstream systems can consume it reliably.

For practitioners, the main edge case is recovery. If a badge is lost, a certificate is compromised, or an authenticator is reset, the process must not force users through unrelated re-enrolment steps that extend downtime. NHIMG’s 52 NHI Breaches Analysis and the State of Non-Human Identity Security both underscore how lifecycle gaps and weak visibility create real exposure. In practice, centralisation works best when it reduces decision points without turning every exception into a cross-functional incident.

Related resources from NHI Mgmt Group

• How do security teams decide whether to replace broad access reviews with more granular approval workflows?
• How do security teams decide whether ASPM should influence developer guardrails or remediation workflows?
• How do security teams decide whether to trust automated endpoint enrichment or apply manual overrides?
• How can teams decide whether modernising API security is worth the disruption?