IAM compliance for NIS2 and ENS needs continuous control

At a glance

What this is: This is a Soffid analysis of IAM compliance under NIS2 and ENS, with the core finding that evidence of continuous access control matters more than static policy documentation.

Why it matters: For IAM, IGA and PAM teams, the practical issue is whether access reviews, recertification and audit evidence can prove current control across human and non-human access paths.

Context

IAM compliance fails when organisations treat access governance as a periodic exercise instead of a continuous control. The article frames NIS2, ENS and ISO 27001 as forcing organisations to prove that permissions are current, justified and enforceable at the point of use.

For identity teams, the governance problem is not whether policies exist but whether access can be demonstrated as controlled in real time. That shifts IAM, IGA and PAM from documentation support functions into operational evidence for audit and risk management.

Key questions

Q: What breaks when identity compliance is still handled through periodic IAM reviews?

A: Periodic IAM reviews break down when access changes faster than certification cycles and evidence is scattered across systems. Teams end up proving yesterday’s control state instead of validating today’s access reality. The result is blind spots, stale entitlements, and audit evidence that cannot keep pace with cloud, SaaS, and privileged workflows.

Q: Why do NIS2 and ENS push IAM programmes toward continuous evidence rather than policy documents?

A: Because these frameworks are applied in contexts where organisations must demonstrate that access controls are operating, not merely described. Static policy documents do not prove that permissions were current, justified and enforceable during real business activity.

Q: How can security teams know if cloud identity governance is actually working?

A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review. If teams still spend days reconstructing access state, governance is not operating continuously. Effective programmes can show current MFA coverage, role scope, and credential age on demand.

Q: Which framework alignment matters most for access control evidence in regulated environments?

A: NIST CSF access permissions and authorisations, IAM lifecycle discipline and regulated-sector requirements all matter, but the key test is whether the organisation can demonstrate live control over entitlements rather than rely on review reports alone.

Technical breakdown

Why periodic recertification falls short for compliance

Periodic access reviews assume that a permission remains stable long enough to be reviewed, questioned and certified on a schedule. That model works poorly when business change, cloud adoption and delegated access create fast-moving entitlement states. In practice, auditors are not only asking whether a control exists, but whether the organisation can show that access was valid at the time it was used. Continuous control closes the gap between policy and operational reality by making access status observable throughout the lifecycle.

Practical implication: treat recertification as one evidence source, not the control model itself.

How IAM, IGA and PAM combine in continuous control

The article positions IGA as the governance layer that creates, changes and removes accounts, while IAM provides the access fabric and PAM handles elevated access paths. Continuous control depends on those functions sharing the same policy intent, identity data and audit trail. If each tool reports separately, the organisation can document access but still fail to prove that the right access existed, for the right reason, at the right time. The governance model only works when identity decisions and enforcement are aligned across the stack.

Practical implication: align lifecycle, privilege and audit data so compliance evidence is produced from the same identity source of truth.

What continuous access evidence looks like in regulated environments

Continuous control means proving that permissions are visible, current and enforceable without waiting for the next review cycle. That includes automated audit records, real-time checks on access legitimacy and recertification workflows that operate as part of normal governance, not as an annual cleanup exercise. In regulated environments, the operational question is whether an assessor can reconstruct who had access, when it changed and why it was allowed. If that history is incomplete, the organisation has compliance paper, not compliance evidence.

Practical implication: build evidence capture into everyday identity operations rather than trying to assemble it for the audit.

NHI Mgmt Group analysis

Continuous access control is now the compliance baseline, not an advanced maturity marker. NIS2, ENS and ISO 27001 are pulling IAM out of the policy-documentation era and into evidence-driven governance. The relevant question is no longer whether an access review exists, but whether the organisation can prove access was justified, current and enforceable when it mattered. For practitioners, this means compliance has become an operational control problem, not a paperwork problem.

IAM compliance fails when governance, enforcement and audit evidence are separated. IGA can certify access, PAM can constrain privilege and IAM can authenticate users, but none of those functions alone proves continuous control. The article's real signal is that compliance breaks where identity data, policy intent and audit records live in different places. Practitioners should read that as a warning that fragmented identity tooling produces brittle evidence even when each tool appears adequate on its own.

Continuous control evidence: the governance requirement is to show that access is always current enough to be trusted. That is a sharper requirement than passing a review cycle, because it assumes an auditor or regulator may ask for proof at any point, not just at the end of a quarter. The implication for identity programmes is that recertification, provisioning and logging must behave like one control system, not three disconnected workflows.

NIS2 and ENS are accelerating convergence between IAM operations and compliance reporting. Organisations that still treat compliance as a downstream reporting function will keep discovering that audit evidence arrives too late to influence actual access risk. The article points toward a market where identity governance is judged by whether it can generate proof as a by-product of normal operation. Practitioners should expect continuous evidence generation to become a core IAM design assumption.

Regulated identity programmes need demonstrable control, not just adaptable policy. The article is strongest where it links sector-specific regulation to the need for real-time visibility, recertification automation and exportable audit trails. That is the direction IAM governance is moving in across public sector, critical services and suppliers to regulated environments. The practical conclusion is that compliance readiness now depends on operationalising identity control rather than describing it.

What this signals

Continuous control becomes the proving ground for IAM maturity. As regulatory pressure rises, organisations will be judged less on whether they can produce a recertification report and more on whether they can show that access states are continuously current. That pushes identity governance closer to operational evidence generation than to annual assurance.

Continuous control evidence: the governance pattern that will separate strong programmes from weak ones is the ability to make access status, justification and revocation visible in the normal identity flow. For practitioners, the design target is no longer an audit binder, but a control fabric that can answer regulators in real time.

For practitioners

• Define continuous control as an identity requirement Translate regulatory expectations into measurable IAM outcomes such as current entitlement status, provable justification and enforceable revocation. Use those outcomes to judge whether your programme is audit-ready or only policy-complete.
• Unify IGA, IAM and PAM evidence Ensure identity creation, access approval, privileged elevation and revocation all write to the same governance record so auditors can trace one control story from request to enforcement.
• Automate recertification as a live control Move review cycles into the normal identity workflow so permissions are revalidated continuously rather than left until the next scheduled campaign.
• Prepare exportable audit trails now Build reporting that can show who had access, when it changed and which policy justified it, because compliance evidence has to survive both internal and external review.

Key takeaways

• IAM compliance is shifting from scheduled review to continuous proof of current access control.
• The main governance gap is the distance between identity policy and the evidence needed to satisfy auditors.
• Practitioners need identity workflows that generate enforcement history, not just access reports.

Key terms

• Continuous Control: A continuous control is a governance mechanism that operates on current state instead of waiting for periodic checkpoints. For access review, that means feeding current entitlement data into review decisions and closing the loop with automatic revocation or follow-up when access is no longer justified.
• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• IAM Compliance: IAM compliance is the practice of using identity and access controls to prove that access is appropriate, monitored, and auditable. It combines governance, logging, and review processes so organisations can show regulators who had access, why they had it, and whether the access matched policy and legal obligations.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.