.svg)
%201.svg)
.svg)
.svg)
Migrate derived PIV credential issuance from Entrust to Axiad Conductor without disrupting existing PKI infrastructure. Reduce licensing costs and give the CIO a consolidated compliance reporting view aligned with OMB zero trust.
Entrust built its federal business on public key infrastructure: certificate authorities, hardware security modules, and the certificates they issue. That layer works, and Conductor runs on top of it wherever an agency wants to keep it. The work federal identity now requires sits above that layer: getting a phishing-resistant credential to every person and machine, keeping it current, revoking it the hour a contract ends, and producing the evidence without an export. That is the layer Axiad built.
.svg)
Certificates, from a CA the agency operates or a managed service.
A separately licensed derived-credential product, help-desk procedure for expiry and separation, and exports for the auditor.
The certificate. Every new device, token, and machine identity is another line item.
The CA, the HSM refresh cycle, the patching, and the specialists who keep it up.
.svg)
Phishing-resistant, hardware-bound credentials for people and machines, from its own FedRAMP Moderate PKI as a Service or against the CA you already run.
Enrollment, renewal, device swap, and revocation from policy, with derived PIV from the card the agency already trusts.
The identity. One active person or machine is one license, however many credentials it carries.
One audit trail across every population, exportable to the SIEM.
.svg)
Conductor runs alongside the CA your agency operates today, Entrust included, and can issue against it. Agencies move in three steps. Each one is reversible, and each one produces its own evidence.
.svg)
Conductor connects to the existing CA and your identity provider over SAML and SCIM. Interim hires, contractors, affiliates, and derived-PIV users enroll first: the populations PIV was never built for, and the ones on passwords today.
.svg)
When the agency is ready, issuance moves to Conductor’s FedRAMP Moderate cloud PKI as a Service. Where the chain has to validate against existing PKI, the issuing CA is cross-signed to your trust anchor. The HSM refresh leaves the budget.
.svg)
When the last certificate the legacy CA issued expires, it is decommissioned. Machine identities join the same lifecycle in the cloud offering through ACME, SCEP, EST, and CMP.
Note: Publicly trusted certificates stay with your existing public CA. Conductor issues private trust.
.svg)
A federal PKI the Department had invested in and trusted, with Entrust issuing derived PIV credentials on top of it.
Derived PIV issuance moved to Axiad Conductor without disrupting the existing PKI. Licensing costs came down, and the CIO gained a consolidated compliance reporting view aligned with OMB zero trust.
In 2026 the Department expanded onto Conductor's FedRAMP Moderate PKI as a Service, bringing machine and workload certificates onto the same lifecycle and audit trail as its people.
30,000 Department users are licensed for derived PIV credentials on Conductor's FedRAMP Moderate cloud offering.
.svg)
Axiad has run PKI and credential lifecycle for the federal government and defense community for more than sixteen years. The populations on this page are the ones we have watched fall outside every PIV program.
OMB M-22-09 requires phishing-resistant MFA for agency staff, contractors, and partners. Most agencies can answer for the PIV holders at a desk. The comparison is about everyone else, and about the people who run the platform.
.svg)
One audit trail across every population the platform issues to, mapped to the NIST SP 800-53 Rev. 5 controls under the FedRAMP authorization, exported to the SIEM the agency already runs. When the Inspector General asks who had access to what on a given date, the answer is a report, not a two-month project. The consolidated compliance reporting view DOJ’s CIO gained is this outcome, in production.
.svg)
Executive Order 14412 sets December 31, 2030 for key establishment and December 31, 2031 for digital signatures to be migrated to post-quantum cryptography. Automation is critical for inventory management, policy enforcement, and compliance reporting. A platform that already renews every credential it issues from policy, and keeps the algorithm on each one, turns the algorithm change into a renewal cycle. Conductor’s support tracks FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA) as your CAs adopt them. Nobody should sell you quantum-safe issuance ahead of that, and we do not.
For the practitioner and the contracting office. Axiad’s column is stated as fact. The other column is the written question to put to the incumbent, so the file carries their answer, not ours.
.svg)
On-premises and air-gapped UCMS runs inside the agency boundary and issues against the CA you operate. It does not carry the authorization, and we will not describe it as if it did.
The validation level (Level 2 or Level 3 partitions) is confirmed per engagement and written into the quote, not asserted on a web page.
Discovery of certificates issued elsewhere in your estate is a separate conversation and a separate product.
We state that up front rather than making you dig for it.
Public-trust certificates stay with your existing public CA; the two coexist.
Quantum-safe issuance follows your CAs’ adoption of FIPS 203, 204, and 205. We do not sell it as shipping ahead of that.
.svg)
.svg)
FedRAMP Moderate Authorized (Conductor). Frost and Sullivan Customer Value Leader. Gartner Market Guide Recognized. ISO/IEC 27001. SOC 2 Type II.
Copyright Axiad 2026. All rights reserved.
.svg)
.svg)
.svg)