Understanding Public-Key Infrastructure: Concepts, Standards, and Deployment Considerations

In-Source Versus Out-Source

In-sourcing is when an enterprise decides to deploy its own internal PKI—utilizing its own resources (including personnel, hardware, and so on) and/or hiring external resources to help with any or all of the PKI's internal operation. The key here is that the PKI is under the control of the enterprise. Out-sourcing is when an organization allows an external party to supply and operate some aspects—perhaps even all aspects—of its PKI. In this case, at least some—perhaps all—of the PKI operation is not under the direct control of the enterprise.

Sometimes the decision of whether to in-source or out-source is based purely on economic considerations. However, it is usually much more complicated than that. Not all organizations ...