Notifications
Clear all
Topic starter
09/07/2026 3:18 pm
TL;DR: Regulations like DORA, NIS2, GDPR, the EU Cyber Resilience Act, PCI DSS, and ISO 27001 increasingly demand control over identities, secrets, keys, certificates, and privileged access because those are the paths attackers use, according to Akeyless. The compliance story is really a governance story: if access, rotation, auditability, and lifecycle are weak, the programme is already behind.
NHIMG editorial — based on content published by Akeyless: managing non-human identities, secrets, and compliance obligations across major regulatory frameworks
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should organisations handle identity and secrets governance for compliance frameworks?
A: They should treat compliance as evidence of working controls, not as a reporting exercise.
Q: Why do secrets and machine identities matter so much in regulatory programmes?
A: Because they are the practical routes into critical systems.
Q: What do security teams get wrong about compliance and identity controls?
A: They often assume policy language or a tool purchase is enough.
Practitioner guidance
- Map compliance obligations to identity controls Create a crosswalk that ties each framework requirement to secrets management, key protection, certificate lifecycle, access governance, and audit logging.
- Inventory machine credentials and certificate owners Assign an accountable owner, lifecycle state, and renewal path for every API key, token, certificate, and service account so orphaned access cannot survive a vendor change or internal reorganisation.
- Replace standing privilege with task-scoped access Restrict elevated access to time-bound, task-bound approvals and keep the issuance record tied to the workload, certificate, or service account that used it.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Framework-by-framework breakdowns of how DORA, NIS2, GDPR, PCI DSS, ISO 27001, and CRA map to identity and cryptographic controls.
- Specific product capabilities for secrets management, machine identity security, encryption, key management, and certificate lifecycle management.
- Detailed examples of how zero-knowledge architecture and distributed fragments cryptography change custody and auditability assumptions.
- The article's own explanation of how AI agent access and secure-by-design expectations intersect with compliance requirements.
👉 Read Akeyless's analysis of identity, secrets, and compliance controls →
Identity and secrets compliance: where are controls still breaking down?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
09/07/2026 3:36 pm
Compliance is now an identity control problem, not a paperwork problem. The article reflects a broader market truth: DORA, NIS2, GDPR, PCI DSS, and ISO 27001 all converge on the same operational evidence, which is control over identities, secrets, keys, certificates, and privileged access. That means governance teams can no longer separate regulatory readiness from NHI and PAM discipline. Practitioners should treat compliance requirements as a test of whether identity controls actually work in production.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to The 2024 ESG Report: Managing Non-Human Identities.
A question worth separating out:
Q: Who is accountable when non-human access causes a compliance failure?
A: Accountability should sit with the teams that own the credential, workload, or service relationship, not with the audit function after the fact. For NHI and cryptographic assets, that means the business or platform owner must be able to explain lifecycle, scope, and revocation decisions before an incident or assessment reveals the gap.
👉 Read our full editorial: Compliance pressure is exposing weak identity and secrets controls
