Skip to content

Credential Management

What is Credential Management?

The processes and tools for securely creating, storing, distributing, rotating, and revoking user credentials throughout their lifecycle.

Information Security

Frameworks that govern credential management

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on credential management

Requirements naming credential management across 6 standards, quoted from the control text.

ISO/IEC 29115:2013 - Entity Authentication Assurance Framework21 controls

Once creation is complete, a credential stored on a hardware device shall be placed in a locked state.

iso-iec-29115-2013-entity-authentication-assurance-framework::10.2.C4 · Credential management control #4: StateLocked (LoA4) →
FIDO2 / WebAuthn2 controls

FIDO Client-to-Authenticator Protocol 2.1 (CTAP2.1, FIDO Alliance Proposed Standard). The protocol between the client (operating system + browser) + authenticator devices. CTAP2.1 COMMANDS: authenticatorMakeCredential (registration);

FIDO2-CTAP2.1-API · FIDO CTAP2.1 Authenticator API Commands and Credential Management →
NIST SP 800-53 Rev 51 control

Use the following external organizations to federate credentials: [Assignment: organization-defined external organizations].

NIST800-IA-5(9) · IA-5(9) Authenticator Management | Federated Credential Management →
NIST SP 800-82 Rev 31 control

Apply strong authentication mechanisms appropriate to the criticality of the OT function, manage credentials securely, and avoid default or shared credentials where operationally feasible.

OT-IAM-2 · Authentication and Credential Management →
API 11641 control

The plan must require identity lifecycle management for every account and credential, whether held by a person, a device or a process;

api-1164::PR.AC-1 · PR.AC-1 Identity lifecycle management for human, device and process accounts; authentication on every interface →
IACS Recommendation No. 194 - Cybersecurity Controls for Existing Ships1 control

Cover physical access security for systems supporting essential services and, where used or applicable, logical access control, digital identity and access management such as role-based access, and credential management.

iacs-recommendation-no-194-cybersecurity-controls-for-existing-ships::C4 · Control 4: Access control (UR E26 4.2.4) →

Questions people ask about credential management

What is Credential Management?
The processes and tools for securely creating, storing, distributing, rotating, and revoking user credentials throughout their lifecycle.
Why is Credential Management important for compliance?
Credential Management is a key concept in Information Security. Understanding credential management helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Credential Management?
Credential Management appears in the requirement text of ISO/IEC 29115:2013 - Entity Authentication Assurance Framework, FIDO2 / WebAuthn, NIST SP 800-53 Rev 5, NIST SP 800-82 Rev 3, API 1164. Across these standards we have identified 27 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Credential Management?
Explore our compliance framework pages to see how credential management applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Credential Management applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.