NIS-2, CRA and eIDAS 2.0 make identity control mandatory

At a glance

What this is: This is a regulatory analysis of how NIS-2, the Cyber Resilience Act and eIDAS 2.0 turn identity and access control into enforceable operational requirements.

Why it matters: It matters because IAM, PAM and identity governance teams must now prove who has access, on what basis, and with what traceability across human and non-human identities.

👉 Read KOBIL's analysis of NIS-2, the Cyber Resilience Act and eIDAS 2.0

Context

NIS-2, the Cyber Resilience Act and eIDAS 2.0 move European security from policy intent to enforceable obligation. The shift matters because compliance now depends on whether organisations can demonstrate access control, accountability and auditability in operational systems, not simply describe them in documents.

The article's central point is that identity has become the control layer regulators can verify. That creates direct implications for IAM, PAM and NHI governance, because shared accounts, weak offboarding and undocumented access paths are exactly the kinds of gaps that fail under inspection.

Key questions

Q: How should organisations implement NIS-2 controls across identity and access management?

A: Start with enforceable identity ownership, least privilege and auditable lifecycle controls for every regulated system. Then prove that approval, access use and revocation are captured in a form supervisors can inspect without reconstruction. If access cannot be traced end to end, the control design is not ready for a compliance regime that now expects operational evidence.

Q: Why do shared accounts and weak offboarding create compliance risk under NIS-2?

A: Because they break accountability. When multiple people use one account, or when a former user retains access, the organisation cannot reliably show who performed an action or whether access was still justified. That undermines both technical control and audit defensibility, which are now central to supervisory expectations.

Q: What do security teams get wrong about compliance in identity governance?

A: Teams often treat compliance as proof that a control exists, when it is really proof that evidence was collected. In identity governance, the harder question is whether access was actually reviewed, rotated, or revoked on time. Good compliance reporting should reflect live control health, not just documented intent.

Q: Who is accountable when identity controls fail under NIS2?

A: Accountability sits with the organisation and its management structure, because NIS2 is built around governance, supervision, and demonstrable risk management. Operational teams may run the controls, but leadership remains responsible for ensuring the controls are defined, monitored, and evidenced well enough to withstand regulatory review.

Technical breakdown

Why identity and access control now anchor NIS-2 compliance

NIS-2 is a governance regime, but it becomes enforceable only through technical controls that limit and evidence access. In hybrid environments, perimeter security cannot answer the regulatory questions of who accessed what, why they had access, and whether the access was appropriate. Identity and access management therefore becomes the mechanism that turns policy into demonstrable control. For organisations with cloud, mobile and third-party access, the identity layer is the only practical place to centralise accountability.

Practical implication: Map regulated systems to explicit identity owners, access paths and audit trails before assuming policy language will satisfy supervisors.

How shared credentials and weak offboarding break traceability

The article highlights a common structural problem in mid-sized organisations: historically grown accounts, shared credentials and missing offboarding. Those conditions destroy traceability because they prevent a reliable answer to who performed an action and under whose authority. In identity governance terms, this is a lifecycle failure, not just an access review issue. When access outlives the worker, contractor or service relationship, the organisation loses evidence quality as well as control quality.

Practical implication: Eliminate shared accounts and tie every identity, including service access, to a lifecycle process that can revoke and evidence removal.

Why regulatory resilience depends on enforced audit trails

The article argues that NIS-2 requires technically enforced logging, reporting and responsibility assignment. That aligns with the broader pattern seen across access governance programmes: if an action cannot be captured, reconstructed and assigned, it is not auditable enough for regulatory defence. This is particularly important where mobile apps, external providers or delegated access sit outside traditional IAM workflows. The control problem is not only access approval but sustained proof of control over time.

Practical implication: Treat audit trail completeness as a control requirement and verify that logs cover approval, use, change and revocation events.

NHI Mgmt Group analysis

Identity has become the compliance substrate, not a supporting control. The article correctly frames NIS-2, the Cyber Resilience Act and eIDAS 2.0 as enforceable regimes, but the real operational shift is that regulators can now test whether identity controls actually exist. Policies, presentations and process descriptions are insufficient if access cannot be enforced and evidenced. For identity programmes, that makes governance architecture the primary compliance surface.

Traceability failure is the real governance gap in mid-sized enterprises. Shared credentials, weak offboarding and unclear role models do more than increase risk. They remove the chain of accountability regulators expect to see, which means the organisation cannot reliably demonstrate who had access at a given moment. This is a lifecycle and ownership problem, not just an IAM tooling problem.

Regulatory resilience will favour organisations that treat identity as infrastructure. The article's strongest insight is that security and access control are no longer peripheral to business operations. They are becoming analogous to finance or production systems, with direct management accountability and repeatable evidence requirements. That shifts identity from a control domain to a board-level operating discipline.

Digital identity is the named concept that connects NIS-2 and eIDAS 2.0. The combination of enforceable security obligations and the European Digital Identity Wallet creates a new trust boundary where identity proof, access control and regulatory evidence intersect. Organisations that continue to separate identity verification from access governance will struggle to build a defensible control model. Practitioners should converge identity proofing, authorisation and auditability into one governance design.

Documentation-only compliance is now a failing assumption. The article exposes the misconception that regulatory readiness can be achieved through policies and audits alone. In practice, supervisors will care whether controls are technically enforced, continuously recorded and capable of surviving inspection. Teams should use that assumption break to reassess where manual evidence gathering is still masking weak control enforcement.

What this signals

NIS-2-style regulation is forcing organisations to close the gap between identity policy and identity enforcement. For IAM and PAM teams, that means the next maturity step is not more documentation but stronger evidence of lifecycle control, approval traceability and revocation discipline across human and non-human identities.

Control evidence debt: the hidden burden of systems that can describe access policy but cannot prove access behaviour. As regulatory regimes converge on technical demonstrability, teams will need to reduce manual evidence collection and replace it with continuously verifiable identity telemetry.

Practically, that pushes programmes toward tighter integration between identity governance, privileged access, mobile trust and third-party access oversight. Where identity proofing and authorisation are separated, audit risk rises faster than most organisations can compensate for with policy updates alone.

For practitioners

• Define regulated identity ownership Assign a named owner for every privileged, workforce and third-party identity in scope for NIS-2, and record the business basis for access so accountability can be traced during review. Use the same ownership model across human and non-human identities to avoid gaps between IAM and operational control.
• Remove shared accounts from regulated processes Replace shared credentials with individually attributable identities wherever access can affect regulated systems, approvals or reporting. Where shared access cannot be eliminated immediately, isolate it, log it separately and place it under a formal retirement plan tied to offboarding.
• Validate auditability before the next supervisory review Test whether you can reconstruct access approval, use, change and revocation across key systems without manual evidence gathering. If the answer depends on spreadsheets or email trails, the control is not yet strong enough for an enforceable regime.
• Converge identity governance across workforce and machine access Extend lifecycle controls to service accounts, API keys and mobile application access where those identities touch regulated business processes. The objective is a single governance view that can show who or what had access, for how long, and under which approval path.

Key takeaways

• NIS-2, the Cyber Resilience Act and eIDAS 2.0 make identity controls a regulatory control surface, not an IT detail.
• Shared accounts, weak offboarding and poor traceability are now compliance liabilities because they break accountability evidence.
• Organisations that can enforce and prove identity lifecycle control will be better positioned for supervisory scrutiny and operational resilience.

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Audit Trail: An audit trail is a record of who accessed a system, what they did, and when they did it. For PHI environments, it provides the evidence needed to investigate incidents, support breach determinations, and demonstrate that access was attributable to a specific identity or workflow.
• Digital Identity Wallet: A digital identity wallet is software that stores and presents credentials for a person or organisation. It is a portability layer, not an authorization system. The wallet moves verified proof between parties, while the relying party still has to decide whether the proof is sufficient for the requested action.
• Lifecycle Control: Lifecycle control is the set of processes that govern access from onboarding through change and removal. In identity programmes, it ensures that provisioning, review, and offboarding stay aligned as applications and permissions evolve. A connector that cannot support lifecycle control may sync data, but it does not fully govern access.

What's in the full article

KOBIL's full article covers the operational detail this post intentionally leaves for the source:

• How KOBIL maps its identity and access architecture to NIS-2, eIDAS 2.0 and the Cyber Resilience Act
• Product-specific traceability and access control details for regulated mobile and workplace workflows
• How the vendor positions its mobile app protection approach against regulatory security requirements
• The article's full list of compliance and implementation claims for mid-sized European organisations

👉 KOBIL's full article expands on identity control, traceability and regulated mobile security.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It gives identity and security practitioners a practical framework for handling lifecycle, access and audit challenges across modern programmes.