IDEF Registry

Entities that issue credentials or tokens MUST have processes and procedures in place to invalidate credentials and tokens.

Service Providers must be capable of revoking, deactivating, or otherwise invalidating credentials or tokens. Invalidated credentials include those that have expired, have been determined to be compromised, or have been canceled by either the issuing entity or user.

Timeliness of revocation and deactivation may be dictated by regulation, environment, or trust frameworks.

FICAM TFPAP Trust Criteria, Token & Credential Management, LOA 2-3, #4 (p.32)

TBA