“Why is identity and access management key to ensure the security of the default configuration settings of assets?" This is the issue that high-level speakers from IBM, NXP, TÜV SÜD and ATOS discussed during the Principle 3 “Security by Default” taskforce’s webinar, on 16 February 2022.

Identified as one of the baseline requirements outlined by the Taskforce, identity and access management means that access to assets must be limited to authorized identities only and managed based on risk and the principle of least privilege. This principle refers to requirements that would only allow access to necessary information and resources.

Find the webinar’s key findings from our speakers below or watch the recorded session if you missed it !

• “Identity and Access management at information system level is fundamental to ensure integrity of the asset during its development and manufacturing” – Security Certification Expert Thomas Ben, NXP

• “ Risk based appropriateness is key when our baseline requirements, in particular Identity and Access Management, are supposed to be applied” – Senior Expert IT Security Josef Gunter, TÜVSÜD

• “A unique identification of an asset or person is mandatory for authentication. It is then leveraged when applying the authorization policy. Unique identities are paramount for asset management” – Thierry Winter, CTO Evidian IAM Products, Atos

Speakers included:

• Sudhir Ethiraj, Global Head of Cybersecurity Office (CSO),

• Angelika Steinacker, CTO Identity & Access Management, IBM

• Josef Güntner, Senior Expert IT Security, TÜV SÜD

• Thomas Ben, Security Certification Expert, NXP

• Thierry Winter, CTO Evidian IAM Products, Atos

You may also like

Charter of Trust launches Cyber Deterrence in the private sector
icon Cyber Deterrence

Charter of Trust launches Cyber Deterrence in the private sector

The Charter of Trust has launched its Cyber Deterrence Working Group to address a central gap in today’s cybersecurity landscape: the disconnect between strong defensive investments and the persistent economic attractiveness of cybercrime. The group brings together industry partners to develop and validate practical deterrence methods that raise attacker cost and risk across sectors and borders.
June 30, 2026
•
Decrypting the Future: Global Timelines for PostQuantum Cryptography and why they matter
icon Post-Quantum Cryptography

Decrypting the Future: Global Timelines for PostQuantum Cryptography and why they matter

The transition to post-quantum cryptography is not a future problem — it is a present one. The threat of adversaries harvesting encrypted data today for decryption once quantum computing matures means that organizations with long-lived data and systems are already exposed. Waiting for cryptographically relevant quantum computers to arrive before acting is not a viable risk management strategy.



Exposure is not uniform across sectors. Financial services, government and defense, operational technology, and healthcare face the sharpest quantum risk, driven by decades-long data retention obligations, slow system replacement cycles, and the societal consequences of cryptographic failure. For these sectors, PQC readiness has moved from best practice to strategic imperative.



Globally, the direction of travel is clear. The United States, European Union, United Kingdom, Singapore, and Australia have each established structured PQC transition frameworks, with mandatory deadlines converging around the late 2020s and 2030. Organizations operating across jurisdictions should expect compounding compliance requirements and align migration plans accordingly.



At the same time, the geopolitical dimension of PQC standardization is becoming increasingly salient. The emergence of a “splinternet” infrastructure, characterized by regionally fragmented digital ecosystems, suggests that cryptographic standards diverge along political and strategic lines. As a result, organizations must not only manage technical migration but also navigate a politically charged landscape in which interoperability, regulatory alignment, and long-term cryptographic agility become critical strategic considerations.



This paper offers a comparative overview of regional PQC transition frameworks and identifies the business and systemic risks associated with quantum-vulnerable cryptography, providing insights for organizations preparing for the transition to post-quantum cryptography. Overall, PQC migration is a strategic transformation, not a technical patch. Cryptographic inventory, governance structures, crypto-agility, and supply chain engagement are as central to success as algorithm selection — and organizations that treat PQC readiness as an architectural and organizational challenge will be best positioned as quantum risks continue to mature.
April 07, 2026
•
A Quantum Leap for Cybersecurity: The Charter of Trust’s PQC Ambition
icon Post-Quantum Cryptography

A Quantum Leap for Cybersecurity: The Charter of Trust’s PQC Ambition

The Charter of Trust is taking decisive steps to secure our digital future in the quantum era. As quantum computing advances, the risks to today’s cryptographic systems grow ever more urgent. Our dedicated working group is leading the way in raising awareness, promoting standards-based migration, and fostering collaboration across industries, governments, and academia. Together, we are committed to a proactive, well-coordinated, and risk-driven transition to post-quantum cryptography—ensuring digital trust and resilience for generations to come. Discover our vision and join us as we shape a secure digital world for the quantum age.
November 08, 2026
•