Notifications
Clear all
Topic starter
22/07/2026 4:36 pm
TL;DR: The EU Cyber Resilience Act now pushes secure-by-design infrastructure toward cryptographic identity, deny-by-default access, zero standing privilege, and auditable lifecycle governance, with ENISA’s 2026 playbooks translating those expectations into 22 actionable patterns, according to Teleport. The hard shift is that static credentials and review-after-the-fact identity models no longer fit compliance-backed infrastructure.
NHIMG editorial — based on content published by Teleport: How Teleport Operationalizes the EU Cyber Resilience Act's Secure-by-Design Mandate
By the numbers:
- The EU Cyber Resilience Act (CRA) enters its enforcement window in 2027, but preparations should start now.
- There are 22 actionable security playbooks in ENISA's Secure by Design and Default Playbook v0.4.
Questions worth separating out
Q: How should security teams replace static credentials in CRA-aligned environments?
A: Replace reusable secrets with short-lived certificates or workload identities wherever the platform allows it.
Q: Why does zero standing privilege matter for CRA readiness?
A: Because the CRA expects access decisions to be controlled, bounded, and demonstrable.
Q: What breaks when AI workloads share one broad service identity?
A: A shared service identity creates standing privilege across training, inference, logging, and preprocessing.
Practitioner guidance
- Inventory every static credential in scope Build a full register of SSH keys, database passwords, API tokens, and other reusable secrets across human, service, and AI access paths.
- Make privileged access time-bound by default Require just-in-time approvals for elevated access, with automatic expiry and dual-authorisation for high-risk resources.
- Tie device trust to connection policy Enforce registered-device checks before any privileged session is allowed, especially for admin consoles, databases, and production shells.
What's in the full article
Teleport's full article covers the implementation detail this post intentionally leaves for the source:
- How Teleport maps each CRA and ENISA principle to specific infrastructure controls and product behaviours.
- The full breakdown of its audit trail, session recording, and access request workflow across SSH, Kubernetes, databases, and AI agents.
- The article's detailed treatment of SPIFFE credentials, device trust, and lifecycle management across the full stack.
- The architectural argument tying secure-by-design requirements to identity, policy, and evidence generation.
👉 Read Teleport’s mapping of CRA secure-by-design principles to identity controls →
EU Cyber Resilience Act identity controls: what changes for teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/07/2026 4:41 pm
Cryptographic identity is becoming the compliance baseline for non-human access. The article makes clear that the CRA’s secure-by-design expectations are not satisfied by policy statements alone. Static credentials, shared secrets, and vague machine ownership now create evidence gaps as well as attack surface. For IAM and NHI programmes, the practical conclusion is that identity format is part of compliance posture, not just security hygiene.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to NHI Mgmt Group research.
A question worth separating out:
Q: Who is accountable for lifecycle offboarding when machine access outlives the project?
A: The owning team remains accountable until the credential, role, or workload identity is revoked and the audit trail shows that revocation happened. Lifecycle ownership should be explicit in the access record, especially for partner integrations, service accounts, and AI workloads that may persist beyond the original deployment team.
👉 Read our full editorial: CRA secure-by-design demands new identity controls for AI workloads
