diff --git a/credentials/credentialset.go b/credentials/credentialset.go
index 05a33425..1ddbb322 100644
--- a/credentials/credentialset.go
+++ b/credentials/credentialset.go
@@ -8,12 +8,27 @@ import (
 	"gopkg.in/yaml.v2"
 
 	"github.com/cnabio/cnab-go/bundle"
+	"github.com/cnabio/cnab-go/schema"
 	"github.com/cnabio/cnab-go/secrets"
 	"github.com/cnabio/cnab-go/valuesource"
 )
 
+const (
+	// DefaultSchemaVersion is the default SchemaVersion value
+	// set on new CredentialSet instances, and is the semver portion
+	// of CNABSpecVersion.
+	DefaultSchemaVersion = schema.Version("1.0.0-DRAFT+b6c701f")
+
+	// CNABSpecVersion represents the CNAB Spec version of the Credentials
+	// that this library implements
+	// This value is prefixed with e.g. `cnab-credentials-` so isn't itself valid semver.
+	CNABSpecVersion string = "cnab-credentialsets-" + string(DefaultSchemaVersion)
+)
+
 // CredentialSet represents a collection of credentials
 type CredentialSet struct {
+	// SchemaVersion is the version of the credential-set schema.
+	SchemaVersion schema.Version `json:"schemaVersion" yaml:"schemaVersion"`
 	// Name is the name of the credentialset.
 	Name string `json:"name" yaml:"name"`
 	// Created timestamp of the credentialset.
@@ -24,6 +39,20 @@ type CredentialSet struct {
 	Credentials []valuesource.Strategy `json:"credentials" yaml:"credentials"`
 }
 
+// NewCredentialSet creates a new CredentialSet with the required fields initialized.
+func NewCredentialSet(name string, creds ...valuesource.Strategy) CredentialSet {
+	now := time.Now()
+	cs := CredentialSet{
+		SchemaVersion: DefaultSchemaVersion,
+		Name:          name,
+		Created:       now,
+		Modified:      now,
+		Credentials:   creds,
+	}
+
+	return cs
+}
+
 // Load a CredentialSet from a file at a given path.
 //
 // It does not load the individual credentials.
diff --git a/credentials/credentialset_test.go b/credentials/credentialset_test.go
index 9ebf055a..83c43e9d 100644
--- a/credentials/credentialset_test.go
+++ b/credentials/credentialset_test.go
@@ -8,8 +8,11 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
+	"github.com/cnabio/cnab-go/schema"
 	"github.com/cnabio/cnab-go/secrets/host"
+	"github.com/cnabio/cnab-go/valuesource"
 )
 
 func TestCredentialSet_ResolveCredentials(t *testing.T) {
@@ -50,3 +53,27 @@ func TestCredentialSet_ResolveCredentials(t *testing.T) {
 		is.Equal(tt.expect, strings.TrimSpace(dest))
 	}
 }
+
+func TestCNABSpecVersion(t *testing.T) {
+	version, err := schema.GetSemver(CNABSpecVersion)
+	require.NoError(t, err)
+	assert.Equal(t, DefaultSchemaVersion, version)
+}
+
+func TestNewCredentialSet(t *testing.T) {
+	cs := NewCredentialSet("mycreds",
+		valuesource.Strategy{
+			Name: "password",
+			Source: valuesource.Source{
+				Key:   "env",
+				Value: "MY_PASSWORD",
+			},
+		})
+
+	assert.Equal(t, "mycreds", cs.Name, "Name was not set")
+	assert.NotEmpty(t, cs.Created, "Created was not set")
+	assert.NotEmpty(t, cs.Modified, "Modified was not set")
+	assert.Equal(t, cs.Created, cs.Modified, "Created and Modified should have the same timestamp")
+	assert.Equal(t, DefaultSchemaVersion, cs.SchemaVersion, "SchemaVersion was not set")
+	assert.Len(t, cs.Credentials, 1, "Credentials should be initialized with 1 value")
+}
diff --git a/credentials/testdata/staging-unix.yaml b/credentials/testdata/staging-unix.yaml
index dc8efb5e..4486a52e 100644
--- a/credentials/testdata/staging-unix.yaml
+++ b/credentials/testdata/staging-unix.yaml
@@ -1,4 +1,5 @@
 name: staging
+schemaVersion: "1.0.0-DRAFT+b6c701f"
 credentials:
   - name: read_file
     source:
diff --git a/credentials/testdata/staging-windows.yaml b/credentials/testdata/staging-windows.yaml
index 670f6edd..6b8022ad 100644
--- a/credentials/testdata/staging-windows.yaml
+++ b/credentials/testdata/staging-windows.yaml
@@ -1,4 +1,5 @@
 name: staging
+schemaVersion: "1.0.0-DRAFT+b6c701f"
 credentials:
   - name: read_file
     source: