PKI Maturity Model Working Group Charter
This Working Group Charter has been created according to the “Working Groups” section of the Bylaws of the PKI Consortium (“PKIC”). In the event of a conflict between this Charter and any provision in either the Bylaws or the IPR Policy, the provision in the Bylaws or IPR Policy shall take precedence.
Summary of the Working Group
| Summary | |
|---|---|
| Name | PKI Maturity Model |
| Abbreviation | PKIMM |
| Mission | To build a PKI maturity model that will be recognized around the globe as a standard for evaluation, planning, and comparison between different PKI implementations |
| Chair(s) | Roman Cinkais (OmniTrust) |
| Vice Chair | Kennedy Nwup (Afield) |
| Communication | Private mailing list, Virtual meetings, Community discussions, GitHub |
| Meeting schedule | Virtual meetings: approximately 1 per month |
| Membership eligibility | All Member types of the PKIC that express the interest in this Working Group |
| Voting structure | According to the PKIC Bylaws |
| Expiration | This Working Group is chartered indefinitely until it is dissolved |
| Members |
A
The Agence Nationale pour la Sécurité Informatique et la Certification Électronique (ANSICE) is the national authority of the Republic of Chad responsible for i…
Afield AB is an independent consultancy providing enterprise architecture and digital transformation advisory services, with an emerging specialization in post-…
Altron Security is Africa’s leading high-trust Digital Trust Services provider, being the first accredited authentication service provider in South Africa Altro…
Amseymour Consulting is a private company that provides services in the field of Risk Assurance, Identity Management, PKI Policies and Procedures, PKI Assessmen…
We provide a complete educational experience and a values-based culture on our modern campus in the heart of West Texas. We are the Ram Family. Join us today.
Consulting on public key infrastructure solutions to organisations in the UK for nearly 20 years to a range of government, public and private sector organisatio…
AppViewX develops products for machine identity management, PKI, and cryptographic automation.
As a full-service business advisory and accounting firm. Aprio’s associates work as integrated teams across advisory, audit, tax, managed, and private client se…
Since 2001, Ascertia has been a global leader in delivering high-trust e-security solutions focusing on Digital Signatures, Timestamps, Evidence Archiving and O…
Astradi is a provider of post-quantum cryptography (PQC) solutions, dedicated to securing digital communication and data against the threat of quantum computers…
B
O Bradesco é um dos líderes do setor financeiro privado e um dos maiores empregadores na categoria. Além disso, apresenta o melhor índice de eficiência entre os…
Bank of America is a global financial institution providing banking, investing, asset management, and other financial services to individuals, small and middle-…
A world-leading centre of excellence in applied post-quantum cryptography. Specialist partner to boards and regulated businesses on the post-quantum transition…
C
CNA provides a broad range of standard and specialized insurance products and services for businesses and professionals in the U.S., Canada and Europe.
Our dedicated efforts help shape public policy, influence regulatory frameworks and establish high professional standards that reflect the evolving needs of the…
CSTI Consulting is a Brazilian boutique technology consultancy specializing in Microsoft Identity and Security infrastructure.
We are a small clinic working on the human side of cybersecurity integration of algorithms and neurotechnology. Currently working on rubber-hose crypto analysis…
CertiPath focuses on the use of digital identity in the modern connected world
Chunghwa Telecom Laboratories specializes in developing PKI systems and serving as a PKI provider in Taiwan.
Cognitive Worlds operates at the intersection of advanced software development and strategic cybersecurity consultancy. We specialize in building the next gener…
Engineering modern business to improve everyday lives. Over the past 30 years, we’ve built relationships with market-leading companies around the world. That’s…
ComSign has vast experience in providing digital signature and PKI solutions to any sized organizations
As a global media and tech company, Comcast reaches hundreds of millions of customers, viewers, and guests with world-class connectivity and platforms and belov…
We help companies build out technical infrastructure to support ecommerce, real time payments, or in a consultive or proof of concept capacity to build new, or…
Concurrent Technologies Corporation, is recognized as one of the top not-for-profit research and developers of comprehensive solutions in the areas of advanced…
A única empresa que suporta um Ecossistema de Cyber-Segurança que inclui Código Fonte/Executável, Certificados Digitais, Criptografia e Defesa de cada canto do…
ConsultingExperts B.V. is a Dutch ICT consultancy that connects highly skilled IT professionals with public and private organizations and provides consultancy,…
We provide the keys for your secure and successful digital transformation - everything to do with PKI, electronic identities, digital certificates, encryption,…
CryptiQ helps discover, assess and migrate vulnerable encryption across your company systems to quantum-safe NIST standards.
We provide expert IT security consultancy services to protect your business from cyber threats. Contact us today for a comprehensive security assessment.
CyberSeQ™ - AI-powered post-quantum cryptography migration platform. Only solution combining CADI discovery with automated refactoring for enterprise PQC compli…
CSNP is a 501(c)(3) nonprofit organization dedicated to transforming global cybersecurity. We strive to create a secure and equitable digital world by providing…
CyberTrust consulting is a boutique cybersecurity company that specialises in PKI, PQC consulting and Identity Security.
Ensure comprehensive protection with Cystel’s IT & OT Security Solutions. Safeguard assets and meet compliance standards in the evolving cyber landscape.
A cybersecurity advisory and product organization focused on helping organizations understand, govern, and reduce technology, vendor, cryptographic, and operati…
D
The Depository Trust and Clearing Corporation (DTCC) advances solutions that help markets grow and protect the security of the global financial system.
We are a Canadian company but also active in the export market. Data & Scientific deployed the secure database for the national ID implementation in one of our…
Decent Cybersecurity provides cutting-edge, quantum-resistant cybersecurity solutions.
Deloitte drives progress, helping clients become leaders. Deloitte invests in outstanding people of diverse talents and backgrounds, empowering them to achieve…
Devise Futures is an innovative organization dedicated to advancing secure digital solutions through expertise in cryptography, identity management, and public…
DictaLabs is a pioneering provider of Public Key Infrastructure (PKI), digital signatures, and cryptographic solutions, dedicated to enhancing trust and securit…
DigiCert is the world's leading provider of scalable TLS/SSL, IoT and PKI solutions for identity and encryption. The most innovative companies, including 88% of…
Digitorus is a software development and consultancy company specialized in Public Key Infrastructure (PKI), Digital Signatures, and Trustworthy Systems (TWS) th…
A pioneer in offering technical trust and confidence in the secure exchange of health information, DirectTrust is committed to collaboration for advancing secur…
An international software vendor fuelled by professional competence and pride in a Digital World, enhancing earnings from the global marketplace and enriching t…
DESC implements the values of reliability, innovation and cooperation to achieve the goals set out by the Dubai Cyber Security Strategy.
The Dutch Ministry of Defence (NL-MoD) has created an internal publicly trusted CA certified according eIDAS. The only subscriber is the NL-MoD. All subjects ar…
E
ECAC, Government of Pakistan is a regulatory body for Certificate Service Providers
Entrust is dedicated to securing identities, data, and transactions around the globe
F
Prepare for the quantum era with F5. Secure apps, APIs, and data with post-quantum cryptography across hybrid multicloud environments.
FEDLIN builds the controls a compliance platform only monitors — and runs them: SOC 2, NIST 800-53 Rev 5, and post-quantum key exchange.
The Federal Public Key Infrastructure Management Authority (FPKIMA) enables government-wide trust by providing trust infrastructure services to federal agencies…
Fidelity International offers investment solutions and retirement expertise to institutions, individuals and their advisers around the world. We bring together…
Interactive PKI education and compliance resources for practitioners. Learn PKI, SSL/TLS, and certificate management through free interactive demos, guides, and…
Forkbomb builds components and solutions for applied Cryptography, Decentralized Identities and DPP
For over 40 years, Futurex has been the industry leader in enterprise data protection solutions. All Futurex products are securely built and signed in the USA.
G
We are GSE, transforming companies into the digital era with secure, reliable certification services.
GLA has emerged as one of the leading universities in India over the years that has been recognised by the UGC. Check out our infrastructure and education progr…
As technology evolves, the need for trusted, verified, and easily deployed digital identities to secure our connections will continue to grow. GlobalSign is the…
H
HID powers the trusted identities of the world's people, places and things, allowing people to transact safely, work productively and travel freely. HID PKIaaS,…
The independent, trusted advocate for nationwide health information exchange.
I
For more than a century, IBM has been a global technology innovator, leading advances in AI, automation and hybrid cloud solutions that help businesses grow.
Eliminate password risks, streamline operations, and foster a secure, productive digital environment. Try Idenprotect now!
Technology center specializing in digital technologies and artificial intelligence, embedded electronic systems, cybersecurity, energy and mechatronics.
For nearly two decades, Inetum has been delivering Public Key Infrastructure (PKI) projects and services across Spain and the Americas. Additionally, we serve a…
The Information Network Security Administration was established for the first time in 1999 under the Council of Ministers Regulation No. 130/1999 with the aim o…
i4p is a Hungarian company, who is first to offer secure multi-party cryptography (MPC) in the certified HSM. Their products are Common Criteria EAL4+ certified…
J
At JISA, we offer Aadhaar Data Vault Solution, HSM Security Solution, Data Security Solution, Encryption Key Management Solution, and many more.
Chase online; credit cards, mortgages, commercial banking, auto loans, investing & retirement planning, checking and business banking.
Jefferies is the leading pure-play investment banking and capital markets firm, purpose-built and driven to deliver for our clients.
K
KHICS Consulting undertakes cybersecurity capability maturity assessments for clients. It relies on the outcomes to enable appropriate security capabilities for…
With passion, curiosity, creativity, and freedom, while firmly rooted in social responsibility, we contribute to the shaping of a sustainable and resilient futu…
Keyfactor develops products for PKI, digital signatures, cryptographic posture management, and cryptography
A shared, verifiable model of reality — identity, ownership, authority and history — for people, organisations and AI. The Reality Infrastructure for the human–…
Explore our comprehensive market research services tailored for businesses looking to gain valuable insights to drive growth and success.
Global leader in intelligent security. We protect critical infrastructure, autonomous systems, and more with Swiss innovation, AI, and advanced cryptography.
At Kyndryl, we design, build, manage and modernize the mission-critical technology systems that the world depends on every day.
L
Expert guidance in quantum readiness, PQC migration, and digital-trust governance for boards and executive leaders. Download Quantum How.
LexisNexis Risk Solutions uses Big Data, proprietary linking and targeted solutions to provide insights that help make organizations more secure and efficient.
LTF is a non-profit foundation 2020, to promote technical awareness, support Libya's ICT sector, and drive digital transformation.
Loblaw Companies Limited is a Canadian retailer with corporate and franchised supermarkets under various banners, as well as pharmacies, banking, and apparel se…
Logius manages PKIoverheid, which is the name for the PKI designed for trustworthy electronic communication within and with the Dutch government. To reach this…
M
With a community bank approach, M&T Bank helps people reach their personal and business goals with banking, mortgage, loan and investment services.
MSC Trustgate, a licensed Certification Authority under Malaysia's Digital Signature Act 1997 since 2000, offers a comprehensive range of digital trust services…
Margins ID systems and Applications (MIDSA) is a company that provides IT solutions related to identity matters.
We protect sensitive data at rest, in transit, & while it’s being processed. We keep your data confidential using the
Methics provides software products for mobile signature solutions to operators and application providers. Methics offers carrier grade products to answer the ne…
Explore Microsoft products and services for your home or business. Shop Surface, Microsoft 365, Xbox, Windows, Azure, and more. Find downloads and get support.
Ministry of Home Affairs, Immigration, Safety and Security
Munich Re is a leading global provider of reinsurance, primary insurance and insurance-related risk solutions.
N
Navy Federal Credit Union is an armed forces bank serving the Navy, Army, Marine Corps, Air Force, Space Force, Coast Guard, veterans, DoD & their families.
Nextwave (Thailand) is Thailand's Leading Cyber Security and Digital Transformation Software distributor in Thailand, with 20 years of experiences in the field…
NgKore is an open-source community driving innovation across Quantum Safe Network, Post-Quantum Cryptography (PQC), eBPF, 5G Advanced, 6G, O-RAN, NTN, AI/ML, Bl…
O
Old Republic Title provides title insurance and settlement services for Title Agents, Real Estate Professionals, Lenders, Homeowners and Commercial Transactions…
Olympus Solutions Inc., an SDVOSB, specializes in cybersecurity systems, identity management, and O&M services. We enhance the ROI of IAM tools.
OmniTrust secures the connected world from silicon to AI through unified Trust Lifecycle Management across devices, identities, and cryptography.
P
PKI Solutions offers the industry-leading PKI Spotlight, the first and only solution purpose-built for PKI posture management and operational readiness.
Delivering enterprise-grade smartcard personalization and printing services to government agencies and financial institutions requiring the highest security sta…
POS DIGICERT, was incorporated in February 1998 to pursue its objective as the premier licensed Certification Authority (CA) in Malaysia. As the Certification A…
PostQ is a software platform focused on helping organizations understand, manage, and transition their cryptographic infrastructure to be resilient against futu…
Protexxa is an AI-driven cybersecurity start-up that offers proactive protection against cyber threats by focusing on the human element of security.
Provimad is a Spanish company specialized in digital transformation services, certified digitization, electronic invoicing, electronic signature solutions, and…
Q
QClairvoyance is a deep-tech startup working on developing next-generation applications that leverage Post-Moore computing architectures, specifically in the fo…
QSE pioneers quantum-resilient encryption solutions to protect data for businesses, governments, and individuals ensuring a secure digital future
QubitOwl offers enterprise cryptographic visibility, PQC assessment, and migration planning to ensure post-quantum readiness and reduce quantum threat risks.
R
Bienvenue sur le site officiel de Renault Group, le groupe automobile de future génération.
Reynolds Rooms Inc., is a small, research‑driven technology and systems development company focused on secure system design, experimental R&D, and compliance‑co…
Specializing in Microsoft Entra Private Access, Windows Always On VPN, Microsoft DirectAccess, and Public Key Infrastructure (PKI).
In our country (Rwanda), we have adopted the enhancement of digital security and trust using the PKI features.
S
SIA is an Indra company located in Spain that is a Trust Service Provider eIDAS compliant and we have our own cryptographic products such as PKI, KMS & digital…
SITG Consulting delivers board‑ready insights on quantum risk, resilience, and survival mandates. Read The Quantum Time Bomb and more. Transformation, Integrity…
SOEBIT is a solution-oriented Cybersecurity, Training, Service & Consultancy Company established in 2003 In the Netherlands.
SSL.com is a publicly-trusted commercial certificate authority expanding the boundaries of encryption and authentication relied upon by users worldwide.
Our expertise spans Open Banking solutions, information security, and FinTech, particularly in the Finance/Banking & FSI, Government, Manufacturing, Telecommuni…
Sectigo partners with organizations of all sizes to deliver automated public and private PKI solutions for securing web servers, user access, connected devices,…
Securemetric is a company based in Kuala Lumpur, founded in 2007, with regional offices in Indonesia, Singapore, Vietnam, and the Philippines. We specialize in…
Securetron is a leading provider of Keys, Certificates, and Digital Signatures Management solution aimed at Simplifying Digital Identity and Data Protection.
SeguriData is a Mexican technology company specializing in Public Key Infrastructure (PKI), digital signatures, digital identity, and data protection
Shree Ojas system and techinfra Pvt Ltd is major PKI consultant and hardware, software integration company in India.
Sixscape is dedicated to making Cryptographic Authentication and Secure Messaging Simple, to enable secure digital transformation, IoT deployment and allow 5G t…
We are committed to driving the transition from digital to the future of quantum technology. Our priority is investing in quantum technologies to help organizat…
Sonic AI is a proprietary signal injection protocol working with numerous governing bodies and rights owners to achieve content authenticity and verification.
Standard Chartered Bank offers personalized banking solutions for your needs. From savings deposits, credit cards, loans, investments & more.
Design, implement and maintain cybersecurity and cryptographic technologies to protect your brand, your firm's irreplaceable competitive advantage, your custome…
T
TCS, a global leader in IT services, consulting, and business solutions, leverages technology for business transformation and helps catalyze change.
TEMET AG is an owner-managed consulting company based in Zurich that specialises in highly qualified consulting services in the field of information security an…
Leading IT distributor & solutions aggregator across Asia Pacific. Serving 22,000+ partners with enterprise technology distribution & enablement.
TechExcel bridges the gap between product development and service/support with a unified platform for ALM, ITSM and customer support.
TecSec’s focus is on Information Security and Information Access Management, enforced through its 7th generation, VEIL® technology cryptography.
We're working with leading PQC experts to provide software for PQC migrations.
Join Australia's largest mobile network, view our plans for NBN broadband internet, mobile phones, 5G & on-demand streaming services.
Terra Quantum is leading quantum technology company, pioneering deep tech innovations across software, hardware and quantum security.
We provide from expert experience services to your company to secure against a wide range of security threats and Risks.
Explore enterprise machine identity automation with Thryam. Replacing operational burden with complete automation.
Engineered for institutional scale. Tridecal orchestrates high-concurrency frameworks, Post-Quantum Cryptography to deliver resilient, sovereign ecosystems for…
Tridum Key is a licensed Certification Authority (CA) in Mongolia, providing digital trust services for both public and private sectors.
Focused on building trust and security in the digital world, TrustAsia is dedicated to delivering sophisticated cybersecurity solutions for customers globally.
Solutions for the electronic and digital signing of electronic documents
TrustSec is founded by internationally recognized information security and cryptography experts. Launched in 2016, the company aims to fill the gap in the cyber…
Tyche Institute is a non-profit research association in Tallinn, Estonia, working on AI governance, evidence, auditability, and open research.
TÜBİTAK BİLGEM continues to be an R&D center that shapes the future and directs the science and technology of the future by making our country a reference point…
U
A distinctive place of learning and academic discourse for innovations and discoveries, where students are prepared to solve the challenging problems of the cha…
L'Université de Sherbrooke offre plus de 400 programmes. Elle se distingue par des méthodes d'apprentissage pratiques, des thèmes porteurs propulsant ses unités…
Unpatterned is an independent research, infrastructure, and knowledge network building open systems for how the world is represented in data, identity, and inte…
Utimaco is a global platform solution provider of trusted Cybersecurity and Compliance solutions and services.
V
We offer Information Technology Solutions to the federal, state and local government as well as private businesses throughout the US.
Focused on vital kidney care and acute organ support therapies, digital solutions and advanced services to extend lives and expand possibilities for patients ev…
Vereign macht überprüfbar, mit wem Organisationen kommunizieren. 800.000+ verifizierte Zustellungen monatlich im Schweizer Gesundheitswesen.
Award-winning credential management system, enabling certificate-based and FIDO authentication methods.
Visa is a trusted world leader in digital payment technology that connects and enables individuals, businesses, and economies to thrive.
W
Wells Fargo is a financial institution that operates its own private PKI and relies on many public PKI, with a strong interest in industry standards (e.g. ASC X…
Explore on-demand technology labs, thought leadership and a portfolio of services designed to help IT and the business undergo digital transformation.
Wyzetree is a specialist advisory firm focused on cryptographic infrastructure, digital trust systems, digital signatures consulting, and post-quantum cryptogra…
Y
Yapı Kredi ayrıcalığı ile kredi, sigorta, ödeme ve daha fazla işlemlerinizi hemen gerçekleştirin! Yapı Kredi avantajları hakkında detaylı bilgi için tıklayın.
Z
We are your trusted advisor for a high performing collaborative and connected supply chain. We help you maximise agility, traceability and visibility through a…
|
Introduction
There is currently no standardized and globally recognized maturity model for PKI. Some available models are very specific and built on top of frameworks like Capability Maturity Model Integration (CMMI), working for specific purposes of the consulting companies.
Our goal is to build a PKI maturity model that will be recognized around the globe as a standard for evaluation, planning, and comparison between different PKI implementations. It can also serve as a basis for additional services connected with the model, like PKI maturity assessment, or implementation and action plans definition for PKI environments. These activities can be extended to any interested parties outside of the PKIC.
The PKI maturity model and assessment methodology will be used as an entry point for anyone evaluating PKI environment by itself or using an independent third party.
The adoption of the PKI maturity model must be very easy and therefore the model must be very clear and understandable by different PKI environments, use-cases, industries, and open, available for anyone to use it. Assessment methodology will be developed to support on-site and automated assessment.
Scope
The scope of this Working Group is to:
- Define and maintain the PKI maturity model with applicable categories and maturity levels
- Define and maintain the PKI maturity assessment methodology including assessment report
- Collect feedback from participants and interested parties regarding the PKI maturity model and assessment process
- Collaborate on reviews of the PKI maturity model, such as model revisions and feedback from participants and interested parties
- Create assessment tools and applications to support the assessment process
Out of scope is:
- Performing assessment of the PKI
Objectives and goals
The objective is to provide a definition of the PKI maturity model and what is the maturity assessment process and procedures to rate the current maturity level according to the model and possibility to track progress for any organization and users of the PKI, independently of the size and use-case.
It should also serve as a basis for the development of the PKI maturity assessment open-source software, applications and tools, which will automate and streamline maturity assessment according to the PKI maturity model and assessment methodology.
The maturity model is based on the Capability Maturity Model Integration (CMMI) developed by Carnegie Mellon University. It should provide the following:
- Quickly understand the current level of capabilities and performance of the PKI
- Support comparison of PKI maturity with similar organizations based on size or industry (anonymized)
- Action plans on how to improve the capabilities of the current PKI
- Improve overall PKI performance
Summary of the planned activities
To achieve the objective and goals of the PKI maturity model, the Working Group will gather feedback from its Members, participants and interested parties regarding the structure of the PKI maturity model leading to development of a robust and recognized model and assessment methodology.
Within the activities carried out by the Members of this Working Group are:
- Regular meetings and discussions on the development of the maturity model and related changes
- Collecting information and feedback from interested parties regarding the maturity model and assessment process
- Contributing to the definition of the overall maturity model, including its categories, maturity levels, and assessment process
- Collaborating on the assessment methodology for maturity model
- Creating awareness about the PKI maturity model, assessment methodology, its adoption and how to use it
- Preparing and publishing the deliverables of this Working Group
Change in activities described in this Working Group Charter must follow the “Decision process” described in this document.
Summary of the deliverables
Based on the objectives and goals, planned activities of this Working Group, the initial deliverables are:
- Documented PKI maturity model
- Documented assessment methodology for the PKI maturity model
- Documented guidelines on how to use the PKI maturity model
- Blog posts and articles to create better awareness about the PKI maturity model, its assessment methodology, adoption, and how to use it
- Assessment tools and applications
All deliverables are licensed under the Creative Commons Attribution 4.0 International (CC BY 4.0) or MIT license and hosted within a public repository under the PKIC GitHub organization.
The change in deliverables described in this Working Group Charter must follow the “Decision process” described in this document.
Means of communication
A private mailing list is used for communication between Working Group Members.
Interested parties can contribute using the community discussions on GitHub and Working Group Members will actively participate in those discussions.
Planning and action items are managed as issues within the same repository as where the deliverables are published.
Membership and participation
Organizations that are eligible to join this Working Group follow the membership process as described in the Bylaws of the PKIC, section “Membership”.
In accordance with the IPR policy, Members that choose to participate in this Working Group must declare their participation prior to participating by contacting the Chair of this Working Group.
The Chair of this Working Group must establish a list for declarations of participation and manage it in accordance with the PKIC Bylaws and the IPR policy and agreement.
Non-members can participate using the community discussions.
Decision process
The decision process follows Bylaws of the PKIC, with reference to sections “Voting” and “Working Group”.
All decisions in this Working Group shall be made by substantial consensus (as determined by the Working Group Chair) of all PKIC Members including interested parties. If substantial consensus cannot be reached (or upon the request of any three PKIC Members), the matter will be submitted for decision by the Executive Council.
IPR policy
This Working Group is subject to the Intellectual Property Rights Agreement, Code of Conduct and Bylaws of the PKIC, including the Antitrust Policy.
Antitrust policy
In accordance with the PKIC antitrust policy, as stated by the PKIC Bylaws, an antitrust statement should be applied and read at the start of all Working Group meetings, in substantially the form written in PKIC Bylaws, chapter “Antitrust Policy”.
Other applicable policies
Any relevant PKIC policies defined by the Bylaws must be followed if not specifically excluded by this Working Group Charter.
