Notifications
Clear all
Topic starter
23/06/2026 9:07 pm
TL;DR: Data sovereignty concerns across jurisdictions, cloud providers, and regulated environments are driving Zero Trust, quantum-safe encryption, IAM, PAM, and secrets management pairings around control continuity, according to SSH Communications Security. The real issue is identity, credentials, and access governance must still hold when infrastructure, legal jurisdiction, and operating ownership are split.
NHIMG editorial — based on content published by SSH Communications Security: the partnership with Intragen on data sovereignty, IAM, PAM, and zero trust
By the numbers:
- 25% of Fortune 100 companies rely on SSH’s solutions.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
Questions worth separating out
Q: How should security teams govern identities in cross-border cloud environments?
A: Security teams should govern identities in cross-border cloud environments by treating access, privilege, and credential custody as one control chain.
Q: Why do IAM and PAM matter to data sovereignty programmes?
A: IAM and PAM matter because sovereignty is only real when the organisation can prove who accessed data, limit how privileged access is used, and revoke it quickly when conditions change.
Q: What breaks when secrets management is separated from identity governance?
A: When secrets management is separated from identity governance, credentials can outlive approvals, regions, or vendor relationships.
Practitioner guidance
- Inventory cross-border access paths Identify every identity, service account, and privileged workflow that can reach data across jurisdictions, then document where approvals, logs, and revocation controls actually sit.
- Unify lifecycle control for IAM, PAM, and secrets Align provisioning, elevation, rotation, and offboarding so that credentials cannot outlive the policy domain that created them.
- Test revocation under jurisdiction change Run scenarios where access must be withdrawn while a session is active in another region or cloud tenant.
What's in the full analysis
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- How the partnership positions IAM transformation across on-premises and trusted cloud environments
- The vendor's framing of quantum-safe encryption alongside Zero Trust access controls
- The specific messaging used to link sovereignty, compliance pressure, and identity control
- The organisational context SSH and Intragen describe for government, critical infrastructure, and regulated enterprises
👉 Read SSH Communications Security's partnership note on data sovereignty and IAM →
Data sovereignty and IAM: what SSH and Intragen change for teams?
Explore further
25/06/2026 2:15 am
Data sovereignty is an identity governance problem before it is a legal or hosting problem. The article frames sovereignty as control over identities, credentials, and data paths across jurisdictions, and that is the right ordering. If IAM cannot preserve authority over who can access what, then sovereignty becomes geographically distributed but operationally fragile. Practitioners should treat sovereignty controls as part of identity architecture, not as a compliance overlay.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Who is accountable when data sovereignty controls fail?
A: Accountability should sit with the teams that own identity lifecycle, privileged access, and secret custody, not just with infrastructure or legal teams. If access is spread across cloud, on-premises, and third-party operations, governance needs one owner for the full access chain, including evidence and revocation.
👉 Read our full editorial: SSH and Intragen partnership reframes data sovereignty for IAM teams
