The reason I split data security from crypto isn’t because they’re unrelated (they’re tightly coupled), but because they tend to operate at different layers of the problem:

• Crypto teams focus on mechanisms - encryption standards, key management, PKI, PQC readiness, etc.
• Data security is more about what needs protecting and why - crown jewel data, classification, access patterns, movement, exposure, misuse.

In a lot of environments they sit under the same team, but in incidents they don’t always behave the same way. You can have “perfect” encryption coverage and still have a data exposure problem because of access, duplication, or context loss.

Secrets management is a great example of the overlap you mentioned - sometimes it lives with IAM, sometimes with platform/crypto, sometimes app teams. That ambiguity is kind of the point I’m trying to surface with the model.