Topic starter
17/08/2026 4:41 pm
TL;DR: Akeyless argues that DORA, C5 and NIS2 turn secrets management into an auditable control plane for credentials, API keys and encryption keys scattered across cloud and application environments. Long-lived secrets, weak rotation and incomplete logging make compliance an operational identity problem, not just a policy requirement.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Simplifying Secrets Management for Compliance (DORA, C5, and NIS2)”.
By the numbers:
- 96% of organizations have secrets scattered across environments, and 70% experienced a leak in the past two years.
- NIS2 requires organizations to report incidents within 24 hours and deliver a detailed report within 72 hours.
Key questions
A: When secrets are scattered, organisations usually lose auditability, slow down remediation, and create inconsistent rotation and revocation practices.
Q: Why do long-lived secrets increase enterprise risk?
A: Long-lived secrets increase risk because they remain usable long after exposure.
Q: How can security teams tell whether secret management is actually working?
A: Look for fewer plaintext secrets, narrower reuse, faster rotation, and a shrinking set of credentials that remain valid across multiple systems.
Practitioner guidance
- Map every secret to an owner and lifecycle state Build a complete inventory of credentials, API keys and encryption keys across code, automation and cloud services, then assign a business owner and expiry state to each one.
- Enforce short-lived access for sensitive secrets Replace standing access with just-in-time credentials wherever possible, and make expiry, revocation and re-issuance policy-driven rather than manual.
- Instrument secret access for incident evidence Ensure logs capture create, read, update, revoke and export events for secrets, and route those events into your incident response and audit processes.
Bottom line: Secrets management in regulated environments is a compliance control because it determines whether credentials, keys and tokens can be governed, audited and revoked across cloud and software systems.
What's in the full article
Akeyless's full article covers the regulatory mapping and implementation detail this post intentionally leaves for the source:
- Framework-by-framework discussion of how DORA, C5 and NIS2 each connect to secrets handling
- Practical examples of centralized secrets storage, JIT credentials and automated rotation in regulated environments
- Explanation of how audit trails support the 24-hour and 72-hour reporting expectations under NIS2
- Discussion of how secrets management supports cloud, on-premises and hybrid compliance consistency
👉 Read Akeyless's analysis of secrets management for DORA, C5 and NIS2 compliance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:46 pm
Secrets compliance is really lifecycle governance for machine credentials: DORA, C5 and NIS2 all push the same underlying issue into view, which is whether organizations can control the full lifecycle of credentials, keys and tokens. When secrets live in code, pipelines and cloud services without a governed lifecycle, compliance becomes an evidence problem rather than a policy problem. The practitioner conclusion is that secrets management must be treated as an identity control, not a storage feature.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when secret access is exposed across AWS, on-premises, and third-party tools?
A: Accountability should sit with the team that owns secrets governance, not with whichever system happens to store the credential. Organisations need clear ownership for lifecycle control, access policy, rotation, and audit evidence across all environments. Without that, gaps appear between cloud teams, platform teams, and security operations, and incidents become harder to trace.
👉 Read our full editorial: Secrets management for compliance: where DORA, C5 and NIS2 converge