Single Sign-On (SSO) – SAML 2.0, OAuth 2.0, OpenID Connect
Multi-Factor Authentication (MFA) – hardware keys (YubiKey), authenticator apps, biometrics
X.509 Certificates – for users, servers, APIs, devices
Privileged Access Management (PAM) credentials – time-bound, least-privilege admin access
Service accounts & API keys (rotated, scoped, audited)
2. Device & Network Credentials
Used to trust machines and connections.
Device certificates (MDM-managed laptops, phones, IoT)
VPN credentials (cert + MFA)
Zero Trust identities (device posture + user identity)
3. Data Protection Credentials
Used to protect sensitive information.
Encryption keys (AES-256, RSA-2048/4096, ECC)
Key Management Systems (KMS / HSMs)
Secrets management (Vaults, AWS Secrets Manager)
4. Compliance & Assurance Credentials (Very important for “enterprise”)
Used to prove security maturity to customers.
ISO/IEC 27001
SOC 2 Type II
GDPR compliance
HIPAA (healthcare)
NIST / CIS alignment
Cyber Essentials / Plus (UK)
5. Governance & Audit Credentials
Used to show control and traceability.
Role-based access control (RBAC)
Audit logs & immutable logging
Access reviews & attestations