Skip to content

Certificate Revocation

What is Certificate Revocation?

The invalidation of a digital certificate before its scheduled expiration date, typically due to key compromise or change of entity information.

Information Security

Frameworks that govern certificate revocation

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on certificate revocation

Requirements naming certificate revocation across 3 standards, quoted from the control text.

Australian Information Security Manual1 control

When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol.

ISM-2050 · When digital signatures are processed by software, they are validated against a certificat →
Lebanon Electronic Transactions and Personal Data Protection Law (Law No. 81/2018)1 control

Lebanon Law 81/2018 Articles 15-25 + LB81-2 + LB81-3 Electronic Signature and Trust Services. Article 15-19 Electronic Signature Validity - electronic signatures recognised with same legal effect as handwritten signatures provided meeting requirements: (a) uni...

LB81-Electronic-Signature-Validity-Certified-Providers-Articles-15-25-LB81-2-3-Trust-Services · Lebanon Law 81/2018 Electronic Signature Validity + Certified Providers + Articles 15-25 →
MITRE D3FEND1 control

Apply D3FEND EVICT tactic to remove adversary access from a system after detected compromise. D3-CE Credential Eviction (D3-ANR Authentication Cache Invalidation + D3-CR Credential Revoking + D3-CRO Credential Rotation + D3-OACA Outbound Authentication Channel...

MITRE-D3FEND-Evict-Tactic-Credential-Process-Eviction-Containment-Incident-Response-Recovery · MITRE D3FEND Evict Tactic + Credential + Process Eviction + Containment + Incident Response + Recovery →

Questions people ask about certificate revocation

What is Certificate Revocation?
The invalidation of a digital certificate before its scheduled expiration date, typically due to key compromise or change of entity information.
Why is Certificate Revocation important for compliance?
Certificate Revocation is a key concept in Information Security. Understanding certificate revocation helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Certificate Revocation?
Certificate Revocation appears in the requirement text of Australian Information Security Manual, Lebanon Electronic Transactions and Personal Data Protection Law (Law No. 81/2018), MITRE D3FEND. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Certificate Revocation?
Explore our compliance framework pages to see how certificate revocation applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Certificate Revocation applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.