Topic starter
09/07/2026 3:18 pm
TL;DR: Akeyless says DORA, NIS2, GDPR, the EU Cyber Resilience Act, PCI DSS and ISO 27001 are pushing organisations to secure identities, secrets, keys, certificates and privileged access because those are the access paths attackers use. Compliance pressure is effectively exposing governance gaps in rotation, auditability and lifecycle control.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “How Akeyless Helps Enterprises Stay Secure and Compliant With EU Cybersecurity Requirements”.
Key questions
Q: What breaks when secrets management is separated from identity governance?
A: When secrets management is separated from identity governance, credentials can outlive approvals, regions, or vendor relationships.
Q: When do privileged credentials become a regulatory problem as well as a security risk?
A: Privileged credentials cross into regulatory risk when they are not time-bound, not auditable or not tied to an accountable owner.
Q: What are the most common compliance mistakes teams make with machine identities?
A: Teams often fail to inventory machine identities as first-class assets, then miss rotation, expiry and offboarding because those controls were built for humans.
Practitioner guidance
- Map compliance obligations to identity control types Create a framework-to-control matrix that links each obligation to the specific secrets, keys, certificates, NHIs or privileged accounts that prove compliance.
- Inventory non-human identities and long-lived secrets Document where service accounts, API keys, tokens and certificates live, who owns them, how they are rotated and when they are retired.
- Replace standing privilege with time-bound access Use Just-in-Time access and Zero Standing Privilege where privileged access is only needed for short operational windows.
Bottom line: Compliance pressure is exposing a governance gap in how organisations control identities, secrets, keys, certificates and privileged access.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Framework-by-framework discussion of how DORA, NIS2, GDPR, PCI DSS and ISO 27001 map to identity and secrets controls
- Product-specific examples of Zero-Knowledge handling for secrets, keys and certificates across regulated environments
- Description of the vendor's platform capabilities for rotation, audit logging and privilege reduction
- Examples of how the vendor positions machine identity security in cloud, DevOps and AI workflows
👉 Read Akeyless's analysis of compliance pressure on identity and secrets controls →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:36 pm
Compliance is exposing identity governance debt, not creating a new problem. The frameworks named in the article are simply making visible what security teams already know: uncontrolled secrets, machine identities and privileged access are operational weaknesses. When DORA, NIS2, GDPR, the EU Cyber Resilience Act and PCI DSS all point at the same control gaps, the issue is not policy overlap. The issue is that the programme has been allowed to drift away from enforceable identity governance.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should security teams balance auditability with zero-knowledge controls?
A: Auditability and zero-knowledge are complementary when the organisation can still prove who accessed what, when and under which authority without exposing raw secrets. The goal is to preserve evidence of control while reducing custody of sensitive material, not to trade one requirement for the other.
👉 Read our full editorial: Compliance pressure is exposing weak identity and secrets controls