Skip to content

Credential Management

What is Credential Management?

The processes and tools for securely creating, storing, distributing, rotating, and revoking user credentials throughout their lifecycle.

Information Security

Frameworks that govern credential management

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on credential management

Requirements naming credential management across 5 standards, quoted from the control text.

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework3 controls

Threats to credential issuance, storage, and revocation including credential theft and compromise

29115-9.3 · Credential management threats →
FIDO2 / WebAuthn2 controls

FIDO Client-to-Authenticator Protocol 2.1 (CTAP2.1, FIDO Alliance Proposed Standard). The protocol between the client (operating system + browser) + authenticator devices. CTAP2.1 COMMANDS: authenticatorMakeCredential (registration);

FIDO2-CTAP2.1-API · FIDO CTAP2.1 Authenticator API Commands and Credential Management →
NIST SP 800-82 Rev 31 control

Apply strong authentication mechanisms appropriate to the criticality of the OT function, manage credentials securely, and avoid default or shared credentials where operationally feasible.

OT-IAM-2 · Authentication and Credential Management →
CIS Controls v81 control

Train workforce members on authentication best practices. Example topics include MFA, password composition, and credential management.

CIS-14.3 · Train Workforce Members on Authentication Best Practices →
IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2)1 control

Govern covers third party cyber risk + supply chain + continuous improvement extending from the 5 functional elements per MSC-FAL.1/Circ.3/Rev.2 + Resolution MSC.428(98).

IMO-MSC-FAL-Govern-ThirdParty-SupplyChain-Manufacturer-Yard-PortFacility-IACS-E26-E27 · IMO MSC-FAL Govern - Third Party Cyber Risk + Supply Chain + Equipment Manufacturer + Yard + Port Facility + IACS UR E26/E27 + Continuous Improvement + Audit →

Questions people ask about credential management

What is Credential Management?
The processes and tools for securely creating, storing, distributing, rotating, and revoking user credentials throughout their lifecycle.
Why is Credential Management important for compliance?
Credential Management is a key concept in Information Security. Understanding credential management helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 686 frameworks with 311K cross-framework control mappings.
Which compliance frameworks address Credential Management?
Credential Management appears in the requirement text of ISO/IEC 29115:2023 - Entity Authentication Assurance Framework, FIDO2 / WebAuthn, NIST SP 800-82 Rev 3, CIS Controls v8, IMO Maritime Cybersecurity Guidelines (MSC-FAL.1/Circ.3/Rev.2). Across these standards we have identified 8 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Credential Management?
Explore our compliance framework pages to see how credential management applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 686 frameworks.

See how Credential Management applies across compliance frameworks

Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.