Skip to content

Certificate Revocation

What is Certificate Revocation?

The invalidation of a digital certificate before its scheduled expiration date, typically due to key compromise or change of entity information.

Information Security

Frameworks that govern certificate revocation

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on certificate revocation

Requirements naming certificate revocation across 3 standards, quoted from the control text.

Australian Information Security Manual1 control

When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol.

ISM-2050 · Validating digital signatures and revocation →
IEC 62351 - Power Systems Communication Security1 control

Revocation is handled through certificate revocation lists, online certificate status or server-based validation with recovery after an end entity's revocation; trust may rest on non-PKI self-signed certificates where a PKI is not available;

iec-62351-power-systems-communication-security::9:5.9 · Part 9, 5.9 to 5.11: revocation (CRL, OCSP, SCVP, recovery), trust via self-signed certificates, authorization and validation lists →
MITRE D3FEND1 control

Apply D3FEND EVICT tactic to remove adversary access from a system after detected compromise. D3-CE Credential Eviction (D3-ANR Authentication Cache Invalidation + D3-CR Credential Revoking + D3-CRO Credential Rotation + D3-OACA Outbound Authentication Channel...

MITRE-D3FEND-Evict-Tactic-Credential-Process-Eviction-Containment-Incident-Response-Recovery · MITRE D3FEND Evict Tactic + Credential + Process Eviction + Containment + Incident Response + Recovery →

Questions people ask about certificate revocation

What is Certificate Revocation?
The invalidation of a digital certificate before its scheduled expiration date, typically due to key compromise or change of entity information.
Why is Certificate Revocation important for compliance?
Certificate Revocation is a key concept in Information Security. Understanding certificate revocation helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Certificate Revocation?
Certificate Revocation appears in the requirement text of Australian Information Security Manual, IEC 62351 - Power Systems Communication Security, MITRE D3FEND. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Certificate Revocation?
Explore our compliance framework pages to see how certificate revocation applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Certificate Revocation applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.