NIS2 compliance demands resilience, not checkbox security

At a glance

What this is: This is a NIS2 compliance guide arguing that regulators now care more about containment, resilience, and accountability than static control presence.

Why it matters: It matters because IAM, PAM, and NHI programmes must now prove they reduce blast radius across users, service accounts, vendors, and legacy systems under failure conditions.

By the numbers:

• Just 1% of ports account for 90% of breaches, but most organizations leave privileged admin ports like SSH, RDP, and RPC open permanently.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.

👉 Read Zero Networks' guide to NIS2 compliance and resilience

Context

NIS2 compliance is not a paper exercise about whether controls exist. The directive asks whether organisations can prove those controls actively limit damage, contain failures, and preserve continuity when an incident occurs, which puts identity governance, privileged access, and segmentation into the same operational conversation.

For IAM, PAM, and NHI teams, that shifts the problem from access provisioning to blast-radius control. Service accounts, vendor connections, administrative ports, and legacy systems all become part of the same resilience model because any one of them can expand impact if privilege is persistent or too broad.

Key questions

Q: What breaks when NIS2 is treated as a checkbox compliance exercise?

A: The programme breaks at the point where controls are assumed to equal resilience. NIS2 asks whether you can contain damage, preserve services, and prove accountability when something fails. If access paths remain broad or privileged routes stay open, the organisation may be compliant on paper but still unable to limit an incident’s impact.

Q: Why do standing privileged paths create NIS2 risk?

A: Standing privileged paths matter because they turn a local compromise into a continuity problem. When administrative ports or vendor routes stay open by default, attackers can move farther and faster than the organisation can contain them. NIS2 pushes teams to prove that privilege is conditional, observable, and limited in blast radius.

Q: What do security teams get wrong about third-party access under NIS2?

A: They often treat vendor access as a connectivity issue instead of a governance issue. NIS2 makes external access part of the regulated attack surface, which means every supplier pathway needs explicit boundaries, ownership, and containment logic. Broad persistent access is not operational convenience; it is unmanaged exposure.

Q: Who is accountable when a NIS2-relevant incident spreads through legacy systems?

A: Accountability sits with the organisation that allowed unmanaged privilege to persist around the legacy environment. If a system cannot support modern identity controls, the compensating controls and containment boundaries still need clear ownership. NIS2 is concerned with whether the business can prove control over impact, not whether the asset is old.

Technical breakdown

Why NIS2 turns identity into a resilience control

NIS2 changes the compliance question from control presence to control effect. In practice, that means security leaders must show how identity and access decisions limit spread, preserve service continuity, and support accountability after failure. Identity is no longer just about granting access correctly. It becomes the mechanism that determines how far an incident can move, which assets remain reachable, and whether recovery requires shutdown or containment. That is why NHI pathways, privileged accounts, and third-party access are now governance issues, not just technical ones.

Practical implication: map privileged and non-human access to containment outcomes, not just approval records.

How privileged access and lateral movement shape NIS2 exposure

The article correctly centres two linked failure modes: open privileged paths and uncontrolled east-west movement. If an attacker can reuse a credential or pivot through a service account, the initial foothold becomes a wider operational incident. Microsegmentation, explicit pathing, and just-in-time elevation reduce that spread by making access conditional on need rather than network position. For NHI governance, this matters because service accounts often inherit standing reach that human access reviews never touch. NIS2 effectively treats that as a continuity risk.

Practical implication: treat every standing privileged path as a potential outage amplifier until its reach is constrained.

Why third-party and legacy access are regulatory issues, not edge cases

NIS2 brings vendor access and legacy systems into the same control model because both can sit outside modern IAM enforcement while still holding operational privilege. Broad VPN access, persistent credentials, and systems that cannot support MFA or current identity controls create paths that evade normal governance. The problem is not only compromise. It is unmanaged reach across environments that a resilience programme is supposed to protect. Under NIS2, those exceptions are no longer exceptions in practice; they are part of the regulated attack surface.

Practical implication: inventory every vendor and legacy pathway that bypasses modern identity enforcement and assign explicit containment rules.

Threat narrative

Attacker objective: The objective is to turn a limited compromise into a broader operational outage or regulatory-impacting incident by expanding blast radius.

1. Entry occurs through persistent privileged access, broad vendor reach, or an open administrative pathway that gives an attacker a stable foothold.
2. Escalation follows when the actor reuses those credentials or moves laterally across east-west paths that were treated as implicitly trusted.
3. Impact lands as service disruption or widespread breach when containment is missing and the incident spreads beyond the original asset.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast-radius control is now the real compliance unit under NIS2. The directive is written around continuity and demonstrable containment, not around the fiction that every control will hold. That means the programme is being judged by how far an incident can travel once something fails, which elevates identity pathing and segmentation into board-level governance. Practitioners should treat containment evidence as the compliance artefact, not just policy documentation.

Just 1% of ports account for 90% of breaches, and that statistic maps directly onto NIS2 privilege risk. When SSH, RDP, RPC, and similar administrative paths remain open by default, the attacker’s problem becomes movement, not access. NIS2 exposes the weakness in programmes that protect the perimeter but leave privileged interior routes ungoverned. Practitioners should assume every standing admin path is a regulatory exposure until it is explicitly constrained.

Vendor access without path restriction is an accountability failure, not a convenience issue. NIS2 makes external connectivity part of the regulated attack surface because third parties often arrive with persistent reach and limited internal visibility. That creates a governance gap where accountability exists on paper but not in the live access model. Practitioners should reframe supplier access as a continuous containment obligation, not a periodic review item.

Legacy systems that cannot support modern identity enforcement create a compliance exception that NIS2 does not ignore. Security teams often treat those environments as out of scope for modern access policy, but the directive’s resilience logic does not permit hidden islands of trust. The operational implication is that organisations must govern the exception itself, because the risk is not the age of the system but the unbounded privilege around it.

From our research:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs , Key Challenges and Risks.
• For the broader breach pattern, see The 52 NHI breaches Report for real-world examples of how identity exposure becomes operational impact.

What this signals

Blast-radius control: NIS2 is forcing organisations to prove that identity decisions reduce impact, not just that access was approved. That means programme maturity will be measured by containment evidence, especially for privileged ports, third-party pathways, and legacy systems that still sit inside critical operations.

With only 5.7% of organisations having full visibility into their service accounts, many teams will struggle to demonstrate the reach of non-human access when regulators ask for evidence. That visibility gap makes identity governance a resilience issue, because you cannot contain what you cannot map.

The practical signal is that IAM, PAM, and network segmentation teams will have to converge around one operating model. Organisations that keep access reviews, privileged paths, and containment boundaries in separate processes will find NIS2 evidence collection slow, inconsistent, and hard to defend.

For practitioners

• Map privileged paths to containment outcomes Identify SSH, RDP, RPC, vendor VPN, and other high-risk routes, then document how each path is blocked, limited, or isolated when an incident occurs.
• Convert standing privilege into conditional access Replace always-on administrative reach with just-in-time elevation and explicit path approval, including service accounts that currently bypass normal review.
• Segment third-party and supplier access by asset need Remove broad remote access patterns and define which internal systems each external identity can reach, with containment boundaries enforced at the network layer.
• Document legacy-system exceptions as governed risk List systems that cannot support modern identity controls, assign owners, and define the compensating controls that prevent uncontrolled lateral movement.

Key takeaways

• NIS2 changes compliance from proving controls exist to proving those controls limit damage when failure occurs.
• Persistent privileged paths, broad vendor reach, and weak containment are the main reasons identity issues become resilience failures.
• Practitioners need to treat blast-radius reduction, not checkbox evidence, as the central governance objective.

Key terms

• Blast Radius: Blast radius is the amount of damage an attacker or failure can cause before containment stops further spread. In identity programmes, it is shaped by privilege scope, network reach, and how quickly access can be constrained once abuse is detected.
• Conditional Privileged Access: Conditional privileged access is administrative access that exists only when specific conditions are met, rather than remaining permanently available. It reduces exposure by tying use of high-risk credentials to approved paths, time limits, and explicit operational need.
• Containment Boundary: A containment boundary is the control line that limits how far a failure, compromise, or misused credential can move through an environment. It can be enforced through segmentation, identity policy, or access path restriction, and it is central to resilience-focused compliance.
• Third-Party Access Path: A third-party access path is any route a vendor, contractor, or partner uses to reach internal systems or data. It becomes a governance problem when it is broad, persistent, or insufficiently segmented, because external access can expand impact beyond the original business need.

What's in the full article

Zero Networks' full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step guidance on preventing lateral movement with microsegmentation and identity-aligned network controls.
• Practical examples of just-in-time MFA for privileged ports, including service accounts and legacy environments.
• Checklist questions for validating whether containment is built into the environment rather than added after detection.
• A compliance-oriented view of how to evidence blast-radius reduction for NIS2 stakeholders.

👉 The full Zero Networks article covers containment design, privileged access enforcement, and third-party segmentation in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.