NIS2 expands identity and access obligations across EU sectors

At a glance

What this is: This is an analysis of how NIS2 widens cybersecurity obligations for EU entities and puts access control, supply chain security, and governance under clearer regulatory pressure.

Why it matters: It matters because IAM, PAM, and NHI programmes now sit inside a compliance perimeter that expects stronger access governance, not just internal policy enforcement.

👉 Read Arcon's analysis of NIS2 identity and access obligations

Context

NIS2 shifts access control from a local security concern to a regulated obligation for a broader set of EU entities. The directive extends coverage beyond the original NIS scope and brings access control, incident handling, supply chain security, and accountability into the same governance frame.

For identity teams, the practical issue is not whether controls already exist, but whether they can be evidenced, assigned, and enforced across privileged users, third parties, and critical services. That makes IAM, PAM, and NHI governance part of regulatory readiness rather than an optional maturity exercise.

Key questions

Q: What breaks when access governance is weak under NIS2?

A: Weak access governance creates both security exposure and compliance failure. If organisations cannot show who approved access, who removed it, and when those decisions happened, they struggle to prove control effectiveness. That gap matters most for contractors, leavers, generic accounts, and sensitive applications where standing access quickly becomes unnecessary trust.

Q: Why do third-party access paths increase NIS2 compliance risk?

A: Because third-party access often sits outside normal joiner-mover-leaver discipline and can survive long after a contract, project, or supplier relationship changes. When vendor accounts, API keys, or remote sessions are not offboarded cleanly, the organisation retains access it can no longer justify or fully monitor.

Q: What are the signs that privileged access management is not strong enough for NIS 2?

A: Warning signs include privileged credentials being exposed or shared, weak session visibility, incomplete audit trails, and limited ability to trace who did what during remote or administrative access. If teams cannot prove access control and monitoring during an audit, the PAM programme is not operating at the level NIS 2 expects.

Q: How should teams balance MFA, least privilege, and business continuity under NIS2?

A: Treat them as complementary controls, not substitutes. MFA reduces credential abuse, least privilege narrows the blast radius, and business continuity planning ensures recovery when controls fail. Under NIS2, the test is whether all three are documented, assigned, and usable during an incident.

Technical breakdown

How NIS2 turns access control into a regulated control surface

NIS2 treats access control as one element of a wider risk management programme, not a standalone technical setting. The article links this to baseline measures such as authentication, multi-factor authentication, encryption, incident handling, and procurement security. In practice, that means access decisions must be tied to governance evidence: who can reach which systems, under what approval model, and with what audit trail. For identity programmes, the regulatory question becomes whether privilege is constrained, reviewable, and defensible across both human and non-human actors.

Practical implication: map privileged access, third-party access, and service credentials to a control owner and an audit evidence source.

Why corporate accountability changes PAM and IAM design

The article makes management accountability explicit, including training, approval, and penalties for non-compliance. That matters because privileged access can no longer be treated as a purely technical administration issue delegated down to operations. Under NIS2, access policy, recertification, and exception handling become governance artefacts that management must be able to stand behind. This shifts the burden from isolated control operation to demonstrable oversight across IAM, PAM, and security leadership.

Practical implication: align privileged access governance to named business accountability and make approvals, reviews, and exceptions traceable.

How supply chain obligations affect third-party and NHI access

NIS2 expands concern beyond the organisation boundary to suppliers, partners, and connected services. That is especially relevant where third-party access is implemented through shared accounts, API keys, certificates, or vendor-managed privileged sessions. Those access paths often outlive the business relationship unless ownership and offboarding are tightly controlled. The article’s supply chain emphasis therefore extends identity governance into third-party lifecycle management, not just contract review.

Practical implication: inventory third-party credentials and privileged paths, then tie each one to lifecycle ownership and offboarding.

Threat narrative

Attacker objective: The objective is to exploit weak privilege governance and extended access paths to move laterally, disrupt operations, or hide activity inside legitimate administration.

1. Entry occurs through privileged or third-party access paths that are not sufficiently constrained, monitored, or evidenced under the organisation's access governance model.
2. Credential or access misuse then becomes harder to distinguish from legitimate administration when access is broad, persistent, or poorly attributed.
3. Escalation follows when privileged actions are not tied to explicit approval, recertification, or session-level controls, creating a wider blast radius.
4. Impact lands as regulatory exposure, operational disruption, or delayed detection because the organisation cannot prove that access governance matched NIS2 expectations.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

NIS2 makes privileged access governance a compliance boundary, not an IT preference. The directive broadens the expected security baseline across more sectors, but the identity lesson is sharper: access control must be provable, reviewable, and linked to risk ownership. Programmes that still treat PAM and IAM as purely operational controls will struggle to show the evidence NIS2 now implies. The practitioner conclusion is straightforward: governance has to sit alongside implementation, not after it.

Access review models built only for internal users are no longer sufficient. NIS2 extends the scope to suppliers and connected services, which means third-party access, vendor-managed sessions, and machine credentials all become part of the same accountability chain. That creates a governance gap when recertification processes do not cover non-human and external identities with the same discipline as employee accounts. Practitioners need one lifecycle model that spans human, NHI, and third-party access paths.

Least privilege under NIS2 is an evidentiary requirement, not just a design principle. The article’s emphasis on access control, MFA, and business continuity shows that regulators will care whether privilege was limited in practice, not whether a policy existed on paper. In identity terms, that means standing privilege, unmanaged exceptions, and shared administrative paths all become regulatory liabilities. The implication is that entitlement scope must be measurable, not assumed.

Third-party access without lifecycle offboarding is the most visible governance failure NIS2 exposes. Supply chain security only works when accounts, tokens, certificates, and privileged sessions are revoked when their business purpose ends. If offboarding is weak, the organisation can meet policy language while still retaining dormant access paths. That is the control gap practitioners should assume auditors will ask about first.

Privilege discovery becomes part of resilience planning under NIS2. The article’s account discovery and audit log emphasis points to a simple reality: you cannot govern what you cannot enumerate. Shadow administrative access, orphaned credentials, and undocumented vendor pathways all undermine both incident response and compliance reporting. For practitioners, the field shift is toward continuous inventory of privileged identities across the estate.

What this signals

Access governance now has to be provable across the whole identity estate. NIS2 does not just raise the bar for controls, it raises the bar for evidence. Teams should expect questions about who approved access, who owns it, how often it is reviewed, and whether third-party and non-human access are included in the same governance model.

Third-party and privileged access need one lifecycle view. The directive’s supply chain language makes it harder to justify separate treatment for employees, suppliers, and service identities. When offboarding, recertification, and exception management are fragmented, the organisation inherits dormant access paths that are difficult to explain under audit.

Privilege discovery becomes a resilience task as much as a compliance task. If you cannot inventory administrative pathways, you cannot assure business continuity, incident response, or accountability. The practical shift is toward continuous visibility into privileged identities, not periodic clean-up after a control review.

For practitioners

• Audit privileged access against NIS2 scope Identify which human, third-party, and non-human identities support essential or important services, then document the approvals, ownership, and evidence for each path.
• Tighten third-party credential lifecycle control Track supplier-issued accounts, API keys, certificates, and remote sessions from creation to offboarding so access does not outlive the business relationship.
• Enforce time-bound privileged access Replace standing administrative access with just-in-time elevation where the task and session can be tied to a named request and review record.
• Evidence access control for management review Keep audit logs, recertification outcomes, and exception approvals in a format leadership can review as proof of NIS2 governance.
• Inventory shadow administrative pathways Discover unmanaged accounts, orphaned credentials, and vendor access routes that are not visible in the normal joiner-mover-leaver process.

Key takeaways

• NIS2 widens identity governance beyond traditional internal access control and makes privileged access part of compliance accountability.
• The directive’s strongest identity impact is on third-party, privileged, and non-human access paths that must be owned and evidenced.
• Teams that can inventory, review, and offboard access cleanly will be better placed to defend both resilience and regulatory posture.

Key terms

• Privileged credential governance: The policies and operating controls that govern high-risk credentials such as tokens, API keys, and application secrets. Effective governance covers issuance, rotation, revocation, ownership, and auditability so that access can be removed cleanly when a vendor incident occurs.
• Third-Party Access Lifecycle: Third-party access lifecycle is the full sequence of granting, using, reviewing, and removing external access to internal systems. It matters because supplier credentials and remote sessions often outlive the business need, creating governance gaps that are difficult to detect without explicit offboarding and review.
• Access Evidence Trail: The access evidence trail is the set of records that proves who had access, why it was granted, who reviewed it, and what changed after review. In PCI DSS 4.0, the trail matters as much as the control because assessors need proof, not assumptions.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.

What's in the full article

Arcon's full article covers the regulatory detail this post intentionally leaves at the governance level:

• The directive's sector coverage and the types of entities brought into scope
• The baseline security measures listed for NIS2, including access control, MFA, and encryption
• The accountability language around management approval, training, and penalties
• The PAM feature set Arcon maps to NIS2 compliance use cases

👉 Arcon's full post covers the NIS2 access control, accountability, and PAM detail behind this analysis.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.