NIS-2, CRA and eIDAS 2.0 make identity control mandatory

At a glance

What this is: This is a regulatory analysis arguing that NIS-2, the Cyber Resilience Act and eIDAS 2.0 turn identity and access control into mandatory operational evidence, not just policy language.

Why it matters: IAM and identity governance teams need to treat access traceability, privilege minimisation and auditable control enforcement as compliance requirements across both human and non-human access paths.

Context

Europe's regulatory baseline for digital security is shifting from guidance to enforceable obligation, and that shift lands first on identity, access control and auditability. When companies must prove who had access, why access was granted, and how incidents were handled, paper controls stop being enough and enforcement moves into the system layer.

That matters for IAM, PAM and broader governance programmes because the article describes a structural change in accountability, not a narrow product requirement. Mid-sized organisations with legacy accounts, shared credentials and weak offboarding are especially exposed, since those weaknesses are precisely what regulators can now test against.

From 2026, the operational question is whether identity controls are technically enforceable, traceable and reportable under scrutiny. For European security teams, that makes identity the control plane for compliance rather than a supporting administration function.

Key questions

Q: What fails first when NIS-2 is handled as documentation instead of enforcement?

A: The first failure is evidentiary. Policies can describe access control, incident handling and accountability, but regulators will look for technical proof that those controls actually operate. When the stack cannot show who accessed what, why access existed, and when it changed, documentation becomes a claim rather than compliance evidence.

Q: Why do shared credentials and stale accounts matter so much under NIS-2?

A: They destroy traceability and ownership. If multiple people use the same access path, or if old accounts remain active after role changes, the organisation cannot reliably prove who was responsible at the time of access. That creates both compliance risk and operational exposure because privilege cannot be defended or revoked cleanly.

Q: How do security teams know if identity controls are supporting privacy compliance?

A: Look for evidence that access decisions are contextual, logged, and reviewable. If the organisation can reconstruct who accessed personal data, why access was allowed, and when privileges changed, identity controls are supporting privacy compliance in a measurable way.

Q: How should organisations govern identity across NIS-2, the Cyber Resilience Act and eIDAS 2.0?

A: Treat identity as a shared governance layer rather than separate compliance tasks. The practical test is whether access, authentication, traceability and reporting can be enforced consistently across systems and business units. If the controls differ by platform, the organisation will struggle to demonstrate a coherent security posture under inspection.

Technical breakdown

Why NIS-2 turns identity into a control plane

NIS-2 raises the standard from policy-based governance to demonstrable technical enforcement. In hybrid environments, the effective control point is identity because access decisions now span cloud services, mobile devices, suppliers and remote users rather than a fixed perimeter. If identity is not authoritative, organisations cannot reliably show who accessed what, on what basis, or whether privilege was appropriate at the time. The regulatory logic therefore depends on identity and access management, not just on network or endpoint controls.

Practical implication: make identity the authoritative layer for access decisions, logging and audit evidence.

Why legacy account sprawl becomes a regulatory liability

Historically grown user accounts, shared credentials and incomplete offboarding are not just hygiene problems under this regulatory regime. They break the chain of evidence required to prove accountability, because no one can clearly explain ownership, purpose, or current authorisation status. In practice, these patterns also undermine segregation of duties and privilege minimisation, which are central to both compliance and resilience. Once supervisors can challenge organisational deficiencies directly, unmanaged accounts become a governance defect rather than a technical nuisance.

Practical implication: inventory shared, stale and orphaned accounts as compliance defects, not housekeeping tasks.

How auditable enforcement differs from documentation

Documentation records intent, while auditable enforcement proves execution. NIS-2 and related frameworks require organisations to enforce access restrictions, capture events automatically and preserve traceable records that stand up to external review. That distinction matters because a policy can say privileges are reviewed, but only a system can prove when a privilege was granted, changed or removed. The result is a move from procedural assurance to machine-verifiable control evidence across identity lifecycle, access governance and incident handling.

Practical implication: verify that identity controls generate immutable evidence for provisioning, approvals, changes and revocation.

Threat narrative

Attacker objective: The practical objective is to exploit weak identity governance to gain or retain access in a way that cannot be cleanly challenged, traced or revoked.

1. Entry begins through weak identity governance, where shared credentials, unclear ownership or excessive access create a controllable but undocumented attack surface.
2. Escalation follows when privilege is too broad or offboarding is incomplete, allowing an insider or external actor to reuse access without immediate detection.
3. Impact occurs when organisations cannot prove access legitimacy, enforce least privilege or produce reliable audit evidence during supervision or incident review.

Breaches seen in the wild

• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity governance is now the enforceable boundary of European cyber compliance. The article correctly shows that NIS-2, the Cyber Resilience Act and eIDAS 2.0 move identity from an enabling function to a regulated control plane. That changes how boards and security leaders should think about accountability, because access control is no longer just an IT implementation detail. Practitioners should treat identity governance as part of regulated operational control.

Documentation-first compliance will fail where technical enforcement is absent. A policy that describes least privilege or traceability does not satisfy a regulator if the underlying systems cannot enforce or evidence those requirements. The named concept here is compliance evidence gap: the distance between what a policy says and what the control stack can prove. IAM, PAM and access logging programmes should be judged by whether they can generate audit-grade proof on demand.

Legacy identity sprawl becomes a structural weakness under sanctionable regulation. Shared accounts, unclear ownership and poor offboarding were tolerated in many mid-market environments because the cost of failure was mostly operational. That assumption no longer holds when supervisory authorities can challenge deficiencies directly and management responsibility is explicit. The practical conclusion is that identity inventory and lifecycle control are now governance issues, not back-office tasks.

Regulated resilience now depends on control integration, not point solutions. The article's emphasis on access enforcement, traceability and reporting reflects a broader market direction toward integrated identity control layers that can support both compliance and response. For practitioners, the important question is whether access, approval and evidence flows are unified enough to survive external scrutiny. The answer determines whether compliance scales beyond a one-time assessment.

European identity programmes should be designed for verifiability first. In a regime where sanctions, liability and management accountability are explicit, the control stack must make access decisions observable and defensible throughout the lifecycle. That is the standard now: not whether a process exists, but whether it can be proven under examination. Practitioners should build for verifiable identity control, not procedural comfort.

What this signals

Compliance evidence gap: the main governance risk is no longer whether a policy exists, but whether the identity stack can prove enforcement when challenged. European regulators are moving toward evidence-based supervision, which means IAM and PAM teams need controls that generate durable records at the moment of access, not after an audit request.

The programme impact is immediate for mid-sized organisations with historical account sprawl. Security leaders should expect identity inventory, entitlement review and offboarding to become board-visible control topics because they now sit directly inside sanctionable obligations, not just internal assurance.

Where mobile workflows, external suppliers and remote access are part of regulated operations, identity must be treated as the operational control plane. That means access, approvals and incident reporting need to be stitched together in a way that supports both compliance and resilience under external scrutiny.

For practitioners

• Map regulated systems to identity-owned access paths Identify where human users, service accounts and third parties can reach regulated systems, then assign a clear owner to each access path and approval route.
• Eliminate shared credentials and orphaned accounts Inventory shared logins, stale accounts and unclear role assignments, then remove or reissue them so every active identity can be traced to a responsible owner.
• Prove least privilege with auditable evidence Check whether entitlement reviews, provisioning events and revocations produce evidence that survives external challenge, not just internal policy sign-off.
• Tie incident reporting to identity telemetry Ensure access logs, change records and approval trails can support incident detection, reporting and response obligations without manual reconstruction.
• Treat mobile app protection as part of regulated access control Where mobile applications support regulated workflows, verify that binary-level protection and identity-aware access controls are included in the compliance scope.

Key takeaways

• NIS-2, the Cyber Resilience Act and eIDAS 2.0 change identity governance from a supporting discipline into a regulated control requirement.
• The biggest weakness is not the lack of policies but the lack of technical evidence that access, approval and revocation actually happened.
• Teams that cannot prove ownership, privilege scope and traceability will struggle to defend compliance under supervisory review.

Key terms

• Compliance Gap: The difference between the controls an organisation has in place and the controls required by a law, framework, or internal policy. In identity governance, gaps often appear as missing review evidence, excessive entitlements, weak revocation, or unclear accountability for access decisions.
• Identity Control Plane: An identity control plane is the governance layer that decides who or what can access systems and under what conditions. In practice, it coordinates authentication, authorization, privilege review, and lifecycle management across human and machine identities so access policy is enforced consistently across environments.
• Traceable Access Enforcement: The practice of making access decisions both technically enforceable and reconstructable after the fact. It combines privilege controls, logging and ownership so that each access path can be explained, audited and, if needed, revoked without ambiguity.
• Lifecycle Ownership: Lifecycle ownership is the assignment of responsibility for creating, changing, reviewing, and retiring an identity or its access. For customer and non-human identities, weak lifecycle ownership usually shows up as orphaned access, inconsistent policy enforcement, and unclear accountability during change.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management in the context of regulated access control. It helps security and identity practitioners connect lifecycle enforcement to broader programme accountability.