Case Study: Sandia

Sandia National Laboratories has for more than 70 years delivered essential science and technology to resolve the nation’s most challenging security issues. As a seasoned security provider, they recognized the need to replace their legacy PKI system and turned to Versasec, through Versasec partner Envoy, to migrate their systems.

Moving devices, managing old certificates, and minimizing user overhead and issues is difficult at best without a strong migration path. With the announcement from Microsoft that its Microsoft Identity Manager and Forefront Identity Manager platforms (MIM and FIM) are approaching end-of-life dates, companies are scrambling to find the most seamless and cost-effective route of migration.

Enter Versasec’s vSEC:CMS S-Series.

vSEC:CMS addresses the sticky migration issue by allowing users to import and manage legacy credentials previously used in MIM and FIM. A good case example of how to use Versasec in this way comes from Sandia National Labs, which faced the same issue of an end-of-life management system and a user base of 25,000 employees/users with legacy cards and credentials that would potentially need to be migrated.

Migrating Smart cards from MIM and FIM is accomplished using a built-in export wizard in the vSEC:CMS S-Series Console. With this tool, users can export smart cards and tokens from Microsoft and third-party smart card managers into the vSEC:CMS console. As tokens are imported, they can be replaced or phased out as the new Yubikey PIV tokens are issued to users. Users can also request the new credential themselves using the vSEC:CMS User Self-Service tool, making it easier for IT staff to deploy new tokens.

In August 2020, Envoy Data, Versasec, and the Sandia National Labs Engineering staff began deploying the vSEC:CMS solution in a series of remote assistance sessions. Activities included the following:

  • Producing and deploying the CMS console
  • Configuring MD830 and Yubikey token templates
  • Building a CMS connection to Active Directory, CA, and other supporting services
  • Configuring User Self-Service Portal
  • Confirming working deployment to MD830 and Yubikey tokens
  • Creating documentation of the deployment and configuration process (conducted by Sandia in this case).

The main benefits from the vSEC:CMS, for us is the ability to manage the YubiKey FIPS, manage the Gemalto IDPrime series smartcards and give us the ability to import management data from MIM. The other capabilities that we are also using is the ability to manage the YubiKey PIV card stock and only issue certificates to devices that we have authorized in the CMS. We are also using the User Self-Service portal for device activation to help us with distribution during the Covid-19 pandemic. The ability to renew certificates from the User Self-Service portal will be a big gain on supporting the device.

After confirming creation of working tokens and verifying the token policies were in the correct format, the configuration services were concluded.


Our product suite provides all the software tools to administrate and manage credentials in a secure and convenient way.

Start here

Free Product Trial

Versasec provides enabling IT security products centered on the usage of security devices such as smart cards. Our solutions enable customers to securely authenticate, issue and manage user credentials more cost effectively. Get a free product trial

Job Openings

We are always looking for new exceptional persons to join our team! Find out more about our job openings.

Versasec Support

Versasec customers with an existing support and maintenance contract can access the Versasec Support Portal, offering extensive professional support and maintenance services. The Versasec Support Portal offers a variety of services, allowing for customers and any site visitor to communicate directly with support engineers.

Visit Support

Company Blog

Our blog addresses the latest security trends and stories. The posts discuss how identity and access management are playing a larger role in keeping corporate data safe as well as brand reputations intact.

Visit our Blog
Share this article