A rollup is a blockchain scaling design that processes transactions off chain and posts compressed results back to a base layer for settlement. It helps improve throughput and reduce transaction costs while relying on the underlying chain for security properties, depending on whether the design uses fraud proofs or validity proofs.
Expanded Definition
A rollup is a Layer 2 scaling approach that moves transaction execution off chain while anchoring compressed transaction data or proofs to a base chain for settlement. The operational point is not simply higher throughput, but preserving the base layer’s security assumptions while reducing on chain load. In practice, the design choice usually splits into optimistic rollups, which rely on fraud proofs, and validity rollups, which rely on cryptographic validity proofs.
Definitions are still evolving across vendors and ecosystems, especially around what counts as “on chain” security and how much data must remain available for independent verification. For that reason, rollups are best understood as a settlement model rather than a single product category. The most relevant standards lens for governance is the NIST Cybersecurity Framework 2.0, which helps teams reason about risk, integrity, and recovery even when the underlying system is decentralised.
The most common misapplication is treating a rollup as fully equivalent to the base chain, which occurs when teams assume off chain execution automatically preserves the same trust and finality properties without validating proof assumptions, data availability, or challenge windows.
Examples and Use Cases
Implementing rollups rigorously often introduces a tradeoff between lower transaction cost and added operational complexity, requiring organisations to weigh scale and user experience against proof verification and monitoring overhead.
- A payments application uses a rollup to batch many small transfers, then settles the compressed result on a Layer 1 chain to reduce fees.
- A decentralised exchange uses a validity rollup to improve throughput while relying on succinct proofs for state integrity and faster finality.
- A gaming platform chooses an optimistic rollup to support frequent in game actions, accepting a challenge period as part of the security model.
- A treasury or vault system evaluates whether the rollup’s sequencing and data availability model fits its risk tolerance before moving significant assets.
- An NHI-heavy dApp that issues SPIFFE-style workload identities for automation checks whether rollup-based settlement changes how signing, custody, and recovery workflows are controlled.
For architecture and governance decisions, teams should compare rollup assumptions with the threat and control perspective described in NIST Cybersecurity Framework 2.0 and assess whether the design supports independent verification, incident response, and operational resilience.
Why It Matters for Security Teams
Rollups matter because they shift part of the security boundary away from the base chain and into proof systems, sequencers, bridges, and monitoring processes. If those supporting components are weak, the system can inherit blockchain security at settlement while still exposing users to censorship, delayed finality, faulty proofs, or bridge compromise. Security teams need to understand that “scaling” does not eliminate governance duties; it redistributes them.
This is where identity and key management become especially important. Even in decentralised systems, administrators, validators, sequencers, and automation agents still rely on secrets, signing authority, and access workflows. That makes rollup operations relevant to NHI governance, because compromised service identities or privileged automation can affect transaction integrity, upgrade safety, and recovery procedures. For control mapping, teams may also consult ISO/IEC 27001 for management-system discipline and NIST Cybersecurity Framework 2.0 for risk treatment and continuous oversight.
Organisations typically encounter the real risk of a rollup only after a bridge failure, proof dispute, or sequencer outage, at which point the term becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack surface, NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST AI RMF set the technical controls, and ISO/IEC 27001:2022 define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 | Risk management guidance applies to rollup trust assumptions and settlement dependencies. |
| NIST SP 800-53 Rev 5 | SC-28 | System and information integrity controls map to proof, data, and settlement assurance concerns. |
| ISO/IEC 27001:2022 | ISO 27001 supports governance of secure operations, access control, and resilience around rollups. | |
| NIST AI RMF | AI RMF is relevant where agentic automation or AI tools administer rollup operations. | |
| OWASP Non-Human Identity Top 10 | Rollup environments depend on non-human identities for sequencers, bots, and infrastructure access. |
Document rollup risk ownership, monitor assumptions, and review recovery paths as part of governance.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 26, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
