CalDAV is an extension to WebDAV that lets clients create, read, and manage calendar data on a server. It standardises calendar operations such as scheduling and sharing, but secure deployment depends on strict authorization around each resource and property update, especially when delegation and multi-user access are involved.
Expanded Definition
CalDAV is a calendar-access protocol built on WebDAV and HTTP that allows authorised clients to create, read, update, and delete calendar resources on a server. In NHI and IAM contexts, the important distinction is not the protocol itself, but the identity and authorization model that protects calendar collections, events, attendee data, and delegation relationships.
Definitions vary across vendors when CalDAV is implemented alongside groupware, mobile sync, and service integrations, so the security boundary must be evaluated at the resource level rather than the application label. Standards for WebDAV and calendar data shape the protocol surface, while NIST Cybersecurity Framework 2.0 helps organisations translate that surface into governance, access control, and monitoring requirements. A CalDAV deployment is only as safe as the NHI behind it, including service principals, delegated tokens, and connector accounts.
The most common misapplication is treating CalDAV as a low-risk convenience feature, which occurs when teams allow broad calendar write access without checking who can modify shared events, attendee lists, or recurring series.
Examples and Use Cases
Implementing CalDAV rigorously often introduces synchronisation overhead and stricter permission design, requiring organisations to weigh user convenience against precise resource control.
- A managed calendar service uses CalDAV so a scheduling app can read a user’s availability while only a delegated token can change event titles and invitees.
- A service account syncs conference room calendars across systems, but write access is limited to specific resource collections rather than the entire tenant.
- An executive assistant platform uses delegated access to manage recurring meetings, with per-calendar authorization logs reviewed for every change.
- A migration project imports historical events through CalDAV, using short-lived credentials and scoped access to reduce exposure during bulk updates.
- Security teams compare protocol behavior against identity hygiene guidance in the Ultimate Guide to NHIs while validating sync clients against the NIST Cybersecurity Framework 2.0.
Shared calendars also appear in third-party workflows, where a payroll or staffing tool may only need read access to availability windows, not the ability to alter meeting metadata or invite additional attendees.
Why It Matters in NHI Security
CalDAV matters because calendar systems frequently become an overlooked control plane for sensitive business activity: meeting metadata, executive availability, recurring access patterns, and delegation chains can all reveal or change operationally important information. If service accounts, API keys, or delegated tokens are over-scoped, a compromise can lead to quiet calendar tampering, phishing support through invitation injection, or unauthorized visibility into confidential schedules.
This risk aligns with NHIMG research showing that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, and that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, as documented in the Ultimate Guide to NHIs. For CalDAV, the governance lesson is simple: treat every sync account, delegated credential, and integration token as a non-human identity with a defined lifecycle, not a background utility account.
Organisations typically encounter the operational impact only after a calendar compromise, at which point CalDAV authorization review becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | CalDAV often depends on secret-backed service accounts and delegated tokens that must be tightly managed. |
| NIST CSF 2.0 | PR.AC | CalDAV security hinges on access control, authentication, and monitoring of calendar resources. |
| NIST SP 800-63 | CalDAV integrations rely on authenticated sessions and credential assurance for both users and services. | |
| NIST Zero Trust (SP 800-207) | CalDAV traffic should be treated as untrusted until each request is authenticated and authorised. | |
| OWASP Agentic AI Top 10 | When agents schedule or modify calendars through CalDAV, tool permissions become a direct security boundary. |
Scope CalDAV sync accounts, rotate credentials, and restrict calendar writes to the minimum required objects.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
