Skip to content

Certificate Revocation List

What is Certificate Revocation List?

A list published by a certificate authority of digital certificates that have been revoked before their expiration date.

Information Security

Frameworks that govern certificate revocation list

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on certificate revocation list

Requirements naming certificate revocation list across 3 standards, quoted from the control text.

Australian Information Security Manual1 control

When digital signatures are processed by software, they are validated against a certificate trust chain and checked for revocation using a Certificate Revocation List or with the Online Certificate Status Protocol.

ISM-2050 · Validating digital signatures and revocation →
IEC 62351 - Power Systems Communication Security1 control

Revocation is handled through certificate revocation lists, online certificate status or server-based validation with recovery after an end entity's revocation; trust may rest on non-PKI self-signed certificates where a PKI is not available;

iec-62351-power-systems-communication-security::9:5.9 · Part 9, 5.9 to 5.11: revocation (CRL, OCSP, SCVP, recovery), trust via self-signed certificates, authorization and validation lists →
MITRE D3FEND1 control

Apply D3FEND EVICT tactic to remove adversary access from a system after detected compromise. D3-CE Credential Eviction (D3-ANR Authentication Cache Invalidation + D3-CR Credential Revoking + D3-CRO Credential Rotation + D3-OACA Outbound Authentication Channel...

MITRE-D3FEND-Evict-Tactic-Credential-Process-Eviction-Containment-Incident-Response-Recovery · MITRE D3FEND Evict Tactic + Credential + Process Eviction + Containment + Incident Response + Recovery →

Questions people ask about certificate revocation list

What is Certificate Revocation List?
A list published by a certificate authority of digital certificates that have been revoked before their expiration date.
Why is Certificate Revocation List important for compliance?
Certificate Revocation List is a key concept in Information Security. Understanding certificate revocation list helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Certificate Revocation List?
Certificate Revocation List appears in the requirement text of Australian Information Security Manual, IEC 62351 - Power Systems Communication Security, MITRE D3FEND. Across these standards we have identified 3 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Certificate Revocation List?
Explore our compliance framework pages to see how certificate revocation list applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Certificate Revocation List applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.