DigiCert, Inc. - Experts & Thought Leaders

DigiCert, a pioneer in intelligent trust, announces growing adoption of the X9 Financial PKI as financial institutions modernise secure connections and prepare for approaching security requirements from The Depository Trust & Clearing Corporation (DTCC). Since its introduction in 2025, the X9 Financial PKI has attracted more than 1,900 organisations deploying, evaluating, or testing the infrastructure. Established and governed by the Accredited Standards Committee X9 (ASC X9) and operated by DigiCert, the ASC X9 Financial PKI provides a common framework for organisations to authenticate each other and exchange information securely. ASC X9 Financial PKI supports trusted network connections between institutions, partners, and service providers independently of browser root programs. Critical financial communications “Financial institutions depend on secure connections that extend well beyond their own networks,” said Dean Coclin, Senior Director of Industry Strategy at DigiCert. “The growth in ASC X9 Financial PKI participation reflects demand for a common trust framework built around those relationships. DigiCert is helping organisations put that framework into practice as they prepare for DTCC’s deadlines.” DTCC now requires ASC X9 Financial PKI certificates for certain services that use mutually authenticated network connections, with implementation deadlines of November 30, 2026, in testing environments and December 31, 2026, in production. The requirement marks a significant step in the adoption of ASC X9 Financial PKI for critical financial communications. Browser-trusted certificates Organisations currently participating in or evaluating the ASC X9 Financial PKI ecosystem include leading financial institutions, payment processors, technology providers, and enterprises from sectors such as manufacturing, healthcare, telecommunications, and critical infrastructure.  Changes to public TLS requirements are narrowing the role of browser-trusted certificates, often making them impractical to use for mutual authentication between servers. ASC X9 Financial PKI addresses those needs through a common trust anchor and policies tailored to financial services, supporting mutual TLS authentication without depending on browser root programs. Browser-trusted certificates “The financial sector has always advanced through a shared commitment to stability, trust, and collective progress,” said Sudha Iyer, Chief Officer - PKI & Cryptography at Citi. “Critical infrastructure security delivers its greatest value when the entire ecosystem can participate, rather than only a select few institutions. ASC X9 Financial PKI provide a common foundation that enables banks, financial institutions, and service providers to strengthen security, maintain interoperability, and evolve together at a pace that supports long-term resilience and trust across the industry.” “The ASC X9 Financial PKI was established to address a critical industry need for secure, interoperable communications between financial institutions and their partners,” said Steve Stevens, Executive Director of ASC X9. “DTCC’s adoption demonstrates the value of a common, industry-governed trust framework. Through ASC X9, financial institutions and other stakeholders have a voice in shaping the policies and requirements that will allow the ASC X9 Financial PKI to evolve as technology and industry needs change.” Identify affected connections DigiCert was selected by ASC X9 as a Certificate Authority to provide managed PKI infrastructure and launched the ASC X9 Financial PKI production environment in 2025. Organisations preparing for the DTCC deadlines can obtain the required ASC X9 Financial PKI certificates through DigiCert and should identify affected connections, install the applicable ASC X9 Financial PKI trust chain and allow time for testing before production deployment. More information is available at DigiCert’s X9 PKI solutions page.

DigiCert, a pioneer in intelligent trust, today announced it has achieved ISO/IEC 27001:2022 certification for its information security management system (ISMS) supporting its global Certification Authority (CA) and Trust Services operations. The certification covers the issuance and management of publicly and privately trusted digital certificates, underlying Public Key Infrastructure (PKI) processes, and supporting corporate functions, independently validating DigiCert's risk-based approach to information security. The certification follows a comprehensive independent audit by MSECB against ISO/IEC 27001:2022, the internationally recognised standard for information security management. The assessment evaluated DigiCert's security policies, processes, and controls across operations in 11 countries and its globally distributed remote workforce, reinforcing the company's commitment to protecting sensitive information and continually improving its security practices. Underlying PKI processes “Trust is strongest when it can be independently verified,” said Lakshmi Hanspal, Chief Trust Officer at DigiCert. “ISO 27001 certification gives our customers and partners additional assurance that the same disciplined approach to security and risk management that underpins our solutions also governs how we protect information and operate our business. As cloud environments, machine identities, and AI systems expand, organisations need technology providers that can demonstrate and assert that security and continuous improvement are built into their operations.” DigiCert's ISO/IEC 27001:2022 certification covers the ISMS supporting its CA and Trust Services, including the issuance and management of publicly and privately trusted certificates and underlying PKI processes. The scope also encompasses Governance, Corporate IT Operations, PKI Operations, Authentication & Support, Engineering, Security, Compliance, Risk, Legal, Product, and Human Resources functions, to the extent that they support these services. Distributed remote operations The certification spans operations in the United States, United Kingdom, Ireland, the Netherlands, Belgium, Germany, Switzerland, Latvia, Australia, India, and South Africa, as well as globally distributed remote operations. Within this certified scope, DigiCert's ISMS addresses key areas including: Information security governance and risk management Identity and access controls Data protection and encryption Secure product development and change management Supplier and third-party risk management Vulnerability management and incident response Information security continuity and recovery readiness Employee security awareness and training Security monitoring, performance evaluation and continual improvement Highly regulated industries For customers, particularly those operating in highly regulated industries, ISO/IEC 27001:2022 certification can provide greater confidence in DigiCert’s security practices, support vendor-risk assessments, and help streamline procurement and compliance reviews. The certification also strengthens DigiCert’s ability to meet the security-assurance requirements of global enterprises and public-sector organisations. The achievement builds on DigiCert’s broader portfolio of independently assessed security and compliance programmes. DigiCert undergoes numerous audits annually across its global operations and maintains certifications and attestations that include SOC 2 Type II, WebTrust for Certification Authorities, WebTrust Baseline Requirements, WebTrust Extended Validation and Code Signing, and European Telecommunications Standards Institute standards for qualified trust services. Ongoing surveillance audits Achieving ISO/IEC 27001:2022 certification is not a one-time assessment. DigiCert will undergo ongoing surveillance audits and periodic recertification to demonstrate that its ISMS continues to operate effectively and evolve alongside changing technologies, threats, and regulatory expectations. DigiCert’s ISO/IEC 27001:2022 certificate and additional security and compliance information are available at DigiCert’s Trust Page.

DigiCert, a pioneer in intelligent trust, announces Secure Releases, new functionality in DigiCert Software Trust Manager that helps organisations assess software risk when a release ships and as new vulnerabilities emerge. Part of the DigiCert ONE platform, it brings together information about supported GitHub releases, their software bills of materials (SBOMs), known vulnerabilities, severity, and security scan results. Teams can identify which versions need attention and use that information in their signing and release workflows. Cryptographic bills of materials Signing confirms who produced software and whether it has been altered, but a component can become vulnerable after the software ships. Finding the affected versions can mean piecing together information from repositories, SBOMs, vulnerability databases, and security scanners. Secure Releases brings that information together by release so teams can see what needs attention and act on it. With Software Trust Manager, including Secure Releases, organisations can: Sign software and cryptographic inventories. Sign software bills of materials (SBOMs) and cryptographic bills of materials (CBOMs) so recipients can verify their source and integrity. See and monitor release risk. View dependencies, SBOMs, vulnerabilities, severity, and supported scan results for each release, and identify new risks as vulnerability information changes. Find and address affected releases. See which releases contain a vulnerable component, alert the teams responsible, and, with Premium, find a version of that component that fixes the vulnerability when one is available. Apply release policies. Set vulnerability and SBOM requirements and, where supported, prevent signing or release when those requirements are not met. Share evidence. Sign security evaluations, VEX statements, SLSA attestations, and SARIF reports for customers and auditors. Vulnerability information changes “Software signing proves where code came from and whether it has been altered, but those assurances do not tell teams whether a release contains a newly discovered vulnerability dependency,” said Deepika Chauhan, Chief Product Officer at DigiCert. “Secure Releases brings those pieces together. By connecting release risk to the same policies that govern signing and delivery, organisations can respond faster when exposure changes and keep software from moving forward when it does not meet their requirements.” Secure Releases is available through Software Trust Manager Essentials, Advanced, and Premium. Essentials provides a point-in-time assessment of release risk. Advanced and Premium add ongoing monitoring of SBOM results by release as vulnerability information changes. Premium also suggests a newer version of a vulnerable component when a fix is available and lets organisations block signing or release if the software does not meet their security requirements.