[Enterprise Case Study] A Global Thermal Solutions Leader Deepens Supply Chain Security: OIDC Single Sign-On and HSM Key Protection to Meet Apple and NVIDIA Audit Requirements for Identity and Keys

Background: Rising Supply Chain Security Audit Requirements

The company is a global leader in thermal solutions. In recent years, it has expanded from air-cooling modules for laptops and servers into liquid-cooling products for AI servers, and has entered the supply chains of major technology companies including Apple and NVIDIA. As a key supplier, it must regularly pass its customers' supply chain security audits.

The company had already deployed MAVIS to centralize remote access for third-party vendors (see our earlier case study). As audit requirements tightened, the focus shifted from "how do vendors connect?" to "is every login identity centrally managed?" and "are the keys that protect credentials adequately secured?" That raised new challenges:

• Fragmented identities and out-of-sync account changes: Employees and external staff each held separate credentials for different systems. When someone left or changed roles, IT had to disable accounts system by system, making it easy to miss one. Auditors required single sign-on (SSO) or centralized identity management, so that identities are created and disabled in one place.

• Insufficient layers of key protection: Server credentials and SSH keys were already vaulted centrally, but the keys used to encrypt them also lived in a software environment. Auditors required multiple layers of protection for keys, not a single line of defense.

• Inconsistent standards for internal and external access: Vendor connections were already under control, but internal IT and R&D staff still used their own habits and tools for privileged access. Permission scopes and the completeness of activity records varied, making it hard to prove to auditors that all privileged access followed one standard.

The MAVIS Solution and Its Benefits

To meet the new round of audit requirements, the company expanded its use of the MAVIS privileged access management platform, bringing authentication, key protection, and internal and external access onto a single platform.

1. OIDC Single Sign-On for Centralized Identity Management

To address fragmented identities and delayed account deactivation, MAVIS hands authentication to the company's identity provider (IdP):

• Integration with the existing IdP: MAVIS supports the OpenID Connect (OIDC) protocol and integrates with the company's existing IdP. Users sign in to MAVIS once with their corporate account, with no extra password to remember.

• Identity changes take effect in one place: Because authentication is centralized in the IdP, once an account is disabled there, that identity can no longer sign in to MAVIS via SSO. This reduces the work of closing accounts system by system.

• Role-based permissions: Which devices a user can see after signing in is governed by MAVIS role-based access control (RBAC) and asset permission assignment, so each identity can access only the assets within its responsibilities.

2. HSM for Multi-Layer Key Protection

To address insufficient key protection, MAVIS builds several layers of defense around vaulted credentials:

• Keys stored in tamper-resistant hardware: MAVIS supports integration with the GoTrust ID hardware security module (HSM), which stores and operates encryption keys inside tamper-resistant hardware, strengthening key management for credentials and sensitive data.

• Encryption at rest with integrity verification: Sensitive data is encrypted with AES-128-CBC and verified with HMAC-SHA256 to prevent tampering. Data in transit is protected by HTTPS/TLS.

• Users never touch real credentials: Device credentials and keys are kept in the MAVIS secure vault. Users connect through the platform and never obtain sensitive credentials directly.

3. Unified Governance of Internal and External Access, With Every Privileged Action Recorded

To address inconsistent standards, the company brought privileged access by internal IT and R&D staff into MAVIS, under the same rules as third-party vendors:

• One entry point, one process: Internal staff and vendors both connect to servers and devices through MAVIS, with support for SSH, RDP, and SFTP file transfer. When needed, they obtain access through the just-in-time (JIT) access request and approval workflow.

• Real-time monitoring and immediate termination: Administrators can monitor active sessions and commands in real time and terminate the session immediately when they spot risky activity.

• Complete records for audits: Every session is recorded and logged. Administrators can search command details, replay video, and set log retention policies so complete records are available whenever auditors ask.

Conclusion

From securing vendor connections to centralizing identities and protecting keys in hardware, the company has grown MAVIS from a single-purpose access control tool into a Zero Trust foundation for all privileged access. Every login is verified by the corporate IdP, every key is protected by hardware, and every internal and external connection leaves a traceable record. For manufacturers entering international technology supply chains, audit requirements will only become more detailed. Bringing identity, keys, and access under one mechanism early means the next audit won't start from scratch.