NIS2 access evidence in hospitals: what supervisors will ask for

At a glance

What this is: This is a Crayonic analysis of how NIS2 changes the access control evidence hospitals must be ready to show supervisors.

Why it matters: It matters because IAM, PAM and governance teams in healthcare will be judged on provable control operation, not policy language alone.

By the numbers:

• Member States reported 309 significant cybersecurity incidents affecting healthcare in 2023.

Context

NIS2 is no longer a theoretical compliance topic for hospitals. In much of the EU, it has moved into national law, and the practical question is no longer whether the directive applies but what evidence a supervisor can ask for when access control is reviewed.

For identity and access teams, the core issue is evidencing control operation across human accounts, privileged access, break-glass access and supplier access. The article frames healthcare as a sector where maturity often trails exposure, which makes access governance a supervisory issue as much as an internal security one.

Key questions

Q: What breaks when a hospital cannot prove access controls are working under NIS2?

A: The failure is not only technical. If a hospital cannot show who opened a record, why MFA was or was not used, or how privileged and emergency access were governed, supervisors can treat the control environment as unproven. That creates an evidence gap that weakens compliance, accountability and incident reconstruction at the same time.

Q: Why do shared logins create a supervisory problem in healthcare access reviews?

A: Shared logins break the chain between action and person. When multiple clinicians or staff use one account, the audit trail can no longer prove attribution, which makes access review, incident investigation and regulatory inspection far harder. In hospitals, that is not just inconvenient. It is a governance failure in the identity record itself.

Q: How should hospitals evidence privileged and emergency access for NIS2 inspections?

A: Hospitals should keep separate privileged accounts, log every emergency access event, and review break-glass use after the fact. The key is reconstructability: a supervisor must be able to see who used access, for what reason, and whether the exception stayed within policy. If those artefacts do not exist, the control cannot be demonstrated.

Q: Should supplier access be treated differently from internal user access under NIS2?

A: Yes. Supplier access should be handled as a distinct risk path because external support can bypass normal staff lifecycle controls and introduce extra exposure into critical systems. Hospitals need documented authentication, approval and review for those connections, plus a clear justification for any continuous or elevated access granted to third parties.

Technical breakdown

Why NIS2 access control is now an evidence problem

NIS2 Article 21 is written in broad terms, but the enforcement problem is specific: supervisors can ask whether access control policies are implemented, not merely approved. That shifts the burden from policy text to proof of operation, such as log evidence, review records, MFA decisions and privileged access boundaries. In hospitals, the same requirement spans clinicians, administrators, locum staff, suppliers and emergency access workflows. The directive is therefore not just about authentication strength. It is about whether the organisation can demonstrate that access rights are governed, time-bounded and reviewable in real conditions.

Practical implication: treat access control as an evidential control with logs, approvals and review artefacts, not as a policy document.

Shared logins, privileged accounts and break-glass access under NIS2

The article highlights three control areas that supervisors are likely to probe. Shared ward logins undermine accountability because the audit trail no longer identifies the person behind the session. Separate privileged accounts matter because administration should be isolated from day-to-day clinical use. Break-glass access is acceptable only when it remains time-limited, logged and subject to after-the-fact review. Together these patterns show that NIS2 supervision is less about whether access exists and more about whether exceptional access can be justified, attributed and reconstructed after the fact.

Practical implication: separate standard, privileged and emergency access paths so each can be evidenced independently.

MFA and supplier access need documented risk decisions

NIS2 does not mandate MFA everywhere in identical terms. Instead, it requires proportionate decisions, which means hospitals need a documented rationale for where MFA or continuous authentication is applied and where it is not. Remote access, administrator access and supplier access are the obvious high-risk cases. The same logic applies to third-party support channels, because supplier pathways can become an unreviewed access route into sensitive systems. The security issue is not whether MFA exists somewhere in the estate. It is whether the organisation can explain why a given access path received or did not receive stronger authentication.

Practical implication: record MFA exceptions by access path and tie each one to a documented risk decision.

NHI Mgmt Group analysis

Access control has become an evidence obligation, not a policy exercise: NIS2 supervision turns the question from whether a hospital has written controls into whether it can prove those controls operated at the point of access. That changes the governance model for IAM, PAM and audit readiness alike. The practical conclusion is that access records, approval trails and review outputs now function as regulatory evidence, not optional hygiene.

Shared accounts are the clearest hospital accountability failure: A ward login used by multiple people erases the identity link that supervisors expect to see in any inspection or incident review. This is not a minor logging weakness. It is a structural failure of attributable access, and it weakens both accountability and forensic reconstruction. Practitioners should treat account sharing as an evidence gap that has to be eliminated or tightly compartmentalised.

Emergency access without after-action review creates traceability debt: Break-glass access is legitimate in clinical settings, but it becomes a governance risk when the emergency exception has no durable record, review step or oversight path. The control assumption that exceptional access will be rare and reviewable is only valid if the process forces a trace. The practitioner conclusion is that emergency access must remain reconstructable long after the session ends.

Supplier access is now part of the hospital identity perimeter: NIS2 explicitly brings supply chain security into the access discussion, which means external support channels can no longer sit outside the access governance model. Hospitals that can evidence internal controls but not third-party access are still exposed. The right governance stance is to treat supplier access as a supervised access class with its own approvals, authentication and review trail.

Healthcare exposure makes access governance a board-level control, not an IT issue: The article links sector-wide incident frequency with the likelihood of on-site inspection and random checks, which means access evidence has become a management-body concern. Once supervisory scrutiny is expected, the quality of identity governance becomes part of organisational resilience. The practitioner takeaway is straightforward: boards should ask for access evidence before they are asked for it by a regulator.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Access evidence is becoming the new compliance boundary: Hospitals cannot rely on policy language alone once supervisors can inspect whether controls operated in practice. The programme question shifts to whether identity records, review outputs and exception handling can survive scrutiny without interpretation.

Exception paths now carry the highest governance risk: Break-glass access, supplier access and shared operational accounts are the places where NIS2 evidence usually fails first. Those paths should be reviewed as distinct control domains rather than as edge cases inside a generic access policy.

The practical signal for IAM and PAM teams is that access governance has moved closer to audit readiness, with attribution and reconstructability becoming central design requirements. Where access cannot be tied back to a named person or a documented exception, the control is not ready for supervisory review.

For practitioners

• Document access control as an evidential control Maintain policies, approvals, review cycles and log evidence that show access control is operating, not just approved on paper.
• Separate named, privileged and emergency access Use distinct accounts for daily work, administration and break-glass access so each path can be reviewed and attributed independently.
• Eliminate shared ward logins Assign a named person behind every login where possible, and contain any unavoidable shared account to a tightly defined exception process.
• Record MFA decisions by access path Write down why remote, administrator and supplier access received MFA or continuous authentication, and why any exception was accepted.
• Test leaver and locum offboarding timing Show how quickly access is removed when staff, contractors or students leave, and retain evidence of the last access review.

Key takeaways

• NIS2 turns hospital access control into an evidence question, not a policy statement.
• Shared logins, emergency access and supplier access are the weak points most likely to fail inspection.
• Hospitals that can reconstruct who accessed what, when and why are better positioned for both supervision and incident response.

Key terms

• Access Evidence Trail: The access evidence trail is the set of records that proves who had access, why it was granted, who reviewed it, and what changed after review. In PCI DSS 4.0, the trail matters as much as the control because assessors need proof, not assumptions.
• Break-glass Access: Break-glass access is an emergency path that bypasses normal access controls when standard authentication fails or a critical incident demands immediate intervention. It must be tightly time-bound, logged, and reviewed, because it exists to restore operations without becoming a permanent back door.
• Shared Account: An account used by more than one person or process, often for convenience in operational environments. In identity governance, shared accounts weaken attribution, complicate auditing and make it difficult to prove who performed an action during production or maintenance activity.
• Supplier Access Lifecycle: Supplier access lifecycle is the end-to-end handling of third-party credentials from issuance to revocation. It covers approval, expiry, monitoring, offboarding, and proof of removal. Weak lifecycle control is a common reason supplier access persists after the business need has ended.

Deepen your knowledge

NHI governance, identity lifecycle management, and privileged access management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM, IGA, or PAM programme, it is worth exploring.