TL;DR: NIS2 pushes organisations to treat identity security as a core compliance control, with SailPoint arguing that identity contributes to five of the directive’s ten pillars, including supply chain security, access control and cyber hygiene. The practical conclusion is that access visibility, privileged account control and toxic entitlement remediation now sit inside regulatory risk management, not beside it.
At a glance
What this is: This is a SailPoint analysis of why NIS2 compliance rests on identity control, with identity security mapped to five of the directive’s ten pillars.
Why it matters: It matters because IAM, PAM and NHI governance teams must treat access visibility, least privilege and third-party identity control as regulatory evidence, not just operational hygiene.
By the numbers:
- The article says the supply chain attack type it discusses is 40% more frequent than malware or ransomware attacks.
Context
NIS2 is a cybersecurity compliance regime, but this article frames it as an identity governance problem because the directive only becomes operational when organisations can control who and what has access to critical systems. In practice, that means access control, privileged account governance, segregation of duties and third-party access all become part of the compliance baseline.
The gap many programmes still carry is checkbox governance, where policy exists but access reality is not continuously measured against it. For NIS2, that is not enough: if the organisation cannot prove its identity estate is governed, it cannot prove it has reduced cyber risk in the way the directive expects.
Key questions
Q: What breaks when NIS2 is treated as a checkbox compliance exercise?
A: The programme breaks at the point where controls are assumed to equal resilience. NIS2 asks whether you can contain damage, preserve services, and prove accountability when something fails. If access paths remain broad or privileged routes stay open, the organisation may be compliant on paper but still unable to limit an incident’s impact.
Q: Why do supplier identities create so much NIS2 compliance risk?
A: Supplier identities often have legitimate access but weaker governance than internal users, which makes them easy to overlook in lifecycle reviews and offboarding. That creates residual access, over-privilege and accountability gaps across the supply chain. Under NIS2, those gaps are not only security issues but also evidence that access control is not well governed.
Q: How should IAM teams prioritise NIS2 remediation work?
A: Start with the access conditions that most clearly undermine control: privileged accounts, shared accounts, accounts without owners, unused rights and toxic entitlement accumulation. Those are the clearest signals that identity governance is not keeping pace with the directive’s risk expectations.
Q: What is the difference between policy compliance and identity control for NIS2?
A: Policy compliance says the organisation has rules. Identity control proves those rules are enforced in live access data, including who has access, what they can reach and whether the access is removed when it is no longer justified.
Technical breakdown
Why identity control maps directly to NIS2 risk management
NIS2 Article 21 asks organisations to apply risk management measures across ten areas, and identity security touches five of them because access is a cross-cutting control plane. Named accounts versus generic accounts, privileged access, least privilege and segregation of duties all affect whether risk analysis and information system security policies are enforceable in practice. The technical point is that identity data is not just an inventory problem. It is the evidence layer that shows whether security policy is real, current and measurable across users, service providers and administrators.
Practical implication: build NIS2 evidence around identity controls, not around policy documents alone.
How privileged access and toxic entitlement drift create compliance exposure
Privileged accounts, unused rights and accumulations of access rights become compliance problems when they persist beyond business need or oversight. In identity governance terms, toxic entitlements are not only a security issue, they are proof that access decisions are not being continuously corrected. NIS2 pushes organisations toward demonstrable access control, which means entitlement sprawl, shared accounts and orphaned access all undermine the directive’s intent even if the organisation has passed a one-time audit.
Practical implication: prioritise privileged access reviews and entitlement cleanup before the next compliance checkpoint.
Why supply chain security now depends on third-party identity governance
The article ties NIS2 supply chain risk to non-employee identities such as suppliers, vendors, partners and contractors. That matters because third-party access often arrives with broader reach than internal access, but weaker lifecycle control. Once a partner account is provisioned, the real risk is not just initial authorisation. It is whether that access remains scoped, monitored and removed when the relationship or task changes. In NHI terms, third-party identities are part of the regulated attack surface, not an external exception.
Practical implication: treat supplier and contractor accounts as governed identities with explicit ownership and offboarding.
Threat narrative
Attacker objective: The attacker aims to use trusted third-party access to reach internal systems and create business disruption or compromise.
- Entry occurs through a supplier, vendor, partner or contractor identity that has been granted access into the environment.
- Escalation follows when that access is broader than needed, or when privileged and shared accounts are left insufficiently controlled.
- Impact emerges when supply chain access is used to compromise the organisation or disrupt operations.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity control is the compliance evidence layer behind NIS2. NIS2 is often described as a governance obligation, but this article shows that its practical test is whether identity controls can be demonstrated across the environment. Policies on risk, access, segregation of duties and supply chain security only count when the organisation can prove who had access, why they had it, and when that access was removed. The practitioner conclusion is that identity governance is the evidence mechanism for NIS2, not a separate workstream.
Checkbox governance fails when access reality is unmanaged. The article’s strongest signal is that written policy is not enough if the identity estate still contains shared accounts, unused rights, high-privilege access and toxic accumulations. Those conditions show a compliance model built on documentation rather than control. The practitioner conclusion is that NIS2 exposes the gap between declared governance and actual entitlements.
Third-party identity governance is now a supply chain control, not a vendor-management detail. NIS2 places suppliers, contractors and partners inside the risk perimeter because their access can become the shortest path to compromise. That means third-party NHI governance, including ownership, scoping and offboarding, is no longer optional operational hygiene. The practitioner conclusion is that supply chain resilience now depends on lifecycle control of external identities.
Access visibility is the operating requirement behind effective remediation. If an organisation cannot see accounts without owners, shared accounts or unused rights, it cannot prioritise what to fix first. That is why posture indicators matter: they turn broad compliance obligations into specific remediation queues. The practitioner conclusion is that NIS2 readiness depends on turning identity telemetry into action, not just reporting.
What this signals
Identity governance is now a regulatory operating control, not an adjacent security practice. For NIS2 programmes, the main shift is that access visibility, privilege review and entitlement cleanup become evidence-bearing activities. Teams that still separate compliance reporting from identity operations will struggle to prove that risk is actually being reduced.
Third-party access has to be managed as lifecycle-bound NHI governance. Supplier, contractor and partner accounts should be treated as governed identities with explicit ownership, access scope and removal criteria. Without that lifecycle discipline, supply chain resilience remains aspirational rather than demonstrable.
For practitioners
- Map NIS2 pillars to identity controls Tie the directive’s risk, access, cyber hygiene and supply chain expectations to the specific identity controls that satisfy them in your environment.
- Review privileged and shared accounts first Start with high-risk access that is shared, unmanaged, unused or broadly privileged, because those are the clearest compliance weak points.
- Treat third-party accounts as governed identities Assign ownership, scope and offboarding rules to supplier, contractor and partner access so external identities do not outlive the business need.
- Measure access reality against policy Use visibility into accounts without owners, high privileges and toxic entitlements to prove whether the policy is actually enforced.
Key takeaways
- NIS2 compliance becomes operational only when organisations can prove control over identities, access and privilege across live systems.
- The article frames identity security as contributing to five of the directive’s ten pillars, making access governance central to compliance evidence.
- Third-party access, toxic entitlements and shared accounts are the most obvious places to start because they expose the gap between policy and control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack surface, NIST CSF 2.0 and CIS Controls v8 set the technical controls, and NIS2 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | NIS2 access control, least privilege and entitlement visibility map directly to this CSF subcategory. |
| Recommendation — Apply PR.AA-05 to enforce and evidence access permissions, entitlements and authorizations across identities. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article focuses on shared accounts, unmanaged access and offboarding gaps. |
| Recommendation — Use CIS-5 to govern account lifecycle, remove stale access and reduce shared-account risk. | ||
| NIS2 | Article 21 — Risk management measures | The article directly analyses how NIS2 article 21 depends on identity control. |
| Recommendation — Align identity governance evidence to Article 21 risk-management measures and prove access control in practice. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Supplier and contractor identities outliving the business need is a central failure mode here. |
| NHI-05 — Overprivileged NHI | High privileges and toxic entitlement accumulation are explicit risks in the article. | |
| Recommendation — Review external identity offboarding so supplier and contractor access ends when the relationship ends. Reduce overprivileged identities by tightening access scopes and removing toxic entitlement accumulation. | ||
| MITRE ATT&CK | TA0008 — Lateral Movement | The supply chain compromise path described is fundamentally about trusted access being used to move deeper. |
| Recommendation — Map third-party access paths to TA0008 and constrain how trusted identities can move through the environment. | ||
Key terms
- Identity Security Posture: Identity Security Posture is the overall strength of an organization’s identity controls and the risk they leave exposed. It measures how well identities, credentials, privileges, authentication, authorization, and governance are managed across human and non-human accounts, including detection of drift, excessive access, weak controls, and policy gaps.
- Toxic Entitlement Combination: A toxic entitlement combination is a set of permissions that becomes risky when held together, even if each permission seems acceptable on its own. Auditors look for combinations such as request and approve, create and certify, or administer and review, because they create self-reinforcing control failure.
- Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 25, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org