A credential is information or an artifact presented as evidence of an entity’s identity, qualifications, status, or authorization. During enrollment, a system issues authentication credentials that help an enrollee prove identity on return. Enrollment may also record verified attributes, digital certificates, or biometrics, assign initial roles, and establish account defaults. section 3.4.5 section 3.4.1
Credential trust depends on more than possession:
- Proof attributes when accounts are created or changed, because inaccurate or spoofed attributes can produce unsafe authorization decisions. section 2.6.3
- Check whether credentials and accounts remain valid, current, and revocable; long-lived credentials can preserve stale attributes and enable unauthorized access. section 2.6.3
- For externally issued credentials, verify the issuer, signature, validity period, revocation status, and identifying information against a trusted governance or registry source. section 16.3.1
Onboarding a trusted auditor
ACME reviews AuditsRUs’s accreditation credential from NISA before adding the firm to its trusted issuer registry. Tim verifies the signature, validity period, revocation status, legal name, organizational identifier, and public key. ACME then recognizes credentials that AuditsRUs is authorized to issue, while separately accepting NISA’s certification credential for an individual auditor. The credential therefore supports both organizational trust and later authorization decisions. section 16.3.1
Operationally, credentials are part of an identity lifecycle rather than permanent proof. Enrollment, authentication, attribute maintenance, revocation, auditing, and logging all contribute to confidence that access decisions rely on current evidence. section 2.6.3 section 3.4.5
