As organizations expand their cloud footprint, managing identities and access across multiple platforms has become increasingly complex. Multi-cloud adoption offers flexibility and the ability to leverage best-of-breed services, but it also introduces a growing web of identities, permissions, security controls, and administrative boundaries. Each cloud provider brings its own authentication methods, role structures, and access management models, creating inconsistencies that can increase security and compliance risks if not managed effectively.
Recognizing these challenges, on August 21, 2026, NIST released the initial public draft of Interagency Report 8613, Multi-Cloud Architecture Challenges: Security and Compliance Implications. Among the 23 challenge areas identified, identity and access management stands out as one of the most complex and foundational issues organizations face in multi-cloud environments.
In this blog, we’ll explore why IAM has become a critical multi-cloud challenge, the risks created by fragmented identity management, and the strategies organizations can use to strengthen security and maintain compliance across cloud platforms.
What Is NIST IR 8613?
NIST IR 8613 is an analysis produced by the Multi-Cloud Security Public Working Group (MCSPWG). It categorizes and examines security and authorization challenges that are unique to or significantly amplified by multi-cloud architectures, and highlights areas where additional research could meaningfully reduce risk.
Key details:
- Status: Initial public draft (not a finalized regulation or mandatory control framework)
- Public comment period: Open through October 5, 2026
- Scope: 23 challenge areas spanning IAM, telemetry, configuration management, data protection, and compliance
Why NIST Flags IAM as a Multi-Cloud Security Challenge
The underlying problem is not simply that organizations use more than one cloud provider. It is that each provider operates with its own identity model, role definitions, native security tooling, and shared-responsibility framework.
That fragmentation creates a structural gap. Access policies in one environment do not automatically translate to another. Roles with the same name may carry different permissions. Authentication mechanisms vary. And the organization’s ability to maintain consistent, auditable access control degrades as complexity increases.
NIST’s analysis makes clear this is not a minor operational inconvenience. It is a security exposure that compounds over time.
5 Identity Risks Multi-Cloud Environments Amplify
Multi-cloud architectures do not create entirely new categories of identity risk, but they intensify existing ones to a degree that demands deliberate governance.
- Identity and privilege sprawl. Each cloud provider generates its own accounts, service principals, and roles. Without centralized oversight, identity inventories expand rapidly and become difficult to track.
- Inconsistent access policies. Permissions designed for one platform may not map cleanly to another, resulting in misaligned controls and policy drift.
- Orphaned and stale accounts. When employees change roles or leave an organization, deprovisioning must happen across every connected cloud environment. Missed accounts become unmonitored entry points.
- Excessive privileged access. Privileged accounts that span multiple clouds carry disproportionate risk. Without strong privileged access management, a single compromised credential can affect systems across providers.
- Limited cross-cloud visibility. Organizations that cannot see who has access to what, across all environments, from a single view, cannot effectively assess or reduce their exposure.
What Organizations Should Do About Multi-Cloud IAM
The challenges NIST describes point to a clear set of priorities for organizations operating in multi-cloud environments:
- Centralize identity governance. A unified approach to managing users, roles, entitlements, and access certifications across all cloud environments reduces fragmentation and simplifies oversight.
- Standardize RBAC and enforce least privilege. Role-based access control should follow consistent definitions across providers, not adapt to each platform’s defaults.
- Strengthen authentication. Multi-factor authentication and risk-based authentication should apply uniformly, regardless of which cloud a user is accessing.
- Control privileged accounts through PAM. Privileged access management becomes essential when administrative credentials can reach systems across multiple providers.
- Automate provisioning and deprovisioning. Manual processes cannot keep pace with the speed at which accounts are created and retired across distributed environments.
- Conduct regular entitlement reviews. Periodic access certifications catch drift, remove stale permissions, and support compliance.
- Build unified monitoring and auditability. Organizations need a consolidated view of access activity across clouds to detect anomalies and satisfy audit requirements.
Why Unified Identity Governance Matters More as Cloud Environments Grow
As infrastructure becomes more distributed, identity control cannot remain fragmented across individual cloud platforms. The complexity NIST IR 8613 describes only grows as organizations add providers, services, and workloads.
Centralized identity governance and administration helps organizations manage the full identity lifecycle, from provisioning through certification and deprovisioning, across heterogeneous environments. It enables consistent policy enforcement, real-time visibility into who has access to what, and the auditability that compliance programs require.
NIST’s analysis reinforces what security leaders already understand: cloud identity management is no longer an infrastructure convenience. It is a security imperative.
NIST IR 8613 Is a Signal, Not a Suggestion
NIST IR 8613 is a public draft, not a binding directive. But the challenges it documents are already real for every organization operating across multiple cloud providers. Multi-cloud security is, increasingly, an identity governance problem.
Organizations ready to assess their IAM posture, close multi-cloud identity gaps, or modernize access governance can connect with iQuasar Cyber to discuss where to start.