NIS2 turns identity governance into a compliance requirement

At a glance

What this is: This is SailPoint’s analysis of how NIS2 shifts identity governance from supporting practice to a compliance obligation for critical EU organisations.

Why it matters: It matters because IAM, IGA, and PAM teams now need to treat access reviews, revocation, approvals, and oversight as regulatory controls across human and non-human identities.

By the numbers:

• Only 34% of organisations across the UK, France and Germany had completed preparations for NIS2, according to SailPoint research.
• 90% of companies in an IDSA survey said they had an identity-related breach in the past year, according to SailPoint's article.
• NIS2 non-compliance can cost up to €10 million or 2% of global annual revenue, according to SailPoint.

Context

NIS2 is the EU directive that broadens cybersecurity obligations for entities critical to the economy and society, including sectors such as healthcare, energy, transport, financial market infrastructures, cloud computing services, and data centers. The practical shift for identity teams is that access governance is no longer just an internal control objective; it is part of the regulated security baseline those organisations must demonstrate.

The article frames this as a readiness problem as much as a compliance problem. SailPoint cites survey evidence showing many organisations still need to complete preparations, while the directive’s requirements extend into access revocation, approval workflows, risk analysis, senior-management oversight, and supply chain governance.

For identity programmes, the implication is straightforward: if access, identity reviews, and privileged approval paths are weak, NIS2 exposure is not abstract. The control failure can now surface as regulatory liability, not only as operational risk.

Key questions

Q: What breaks when access governance is weak under NIS2?

A: Weak access governance creates both security exposure and compliance failure. If organisations cannot show who approved access, who removed it, and when those decisions happened, they struggle to prove control effectiveness. That gap matters most for contractors, leavers, generic accounts, and sensitive applications where standing access quickly becomes unnecessary trust.

Q: Why does NIS2 make access revocation and approval more important?

A: Because NIS2 treats them as part of the security measures that critical entities must be able to show in operation. If access lingers after role changes or contractors leave, or if sensitive access is granted without risk analysis, the organisation cannot convincingly demonstrate control over its identity estate. That weakens both compliance and resilience.

Q: How should security teams prepare identity controls for NIS2 audit scrutiny?

A: Teams should make access lifecycle evidence retrievable by design. That means approval trails, entitlement changes, review outcomes, revocation records, and privileged session logs must be tied to the same identity records. If the organisation cannot prove who had access, why they had it, and when it ended, NIS2 readiness is incomplete.

Q: What do security teams get wrong about Zero Trust and identity governance?

A: They often treat Zero Trust as an integration label rather than a continuous operating requirement. If identity signals are inconsistent across tools, the organisation may enforce local checks while still lacking enterprise-wide assurance. The mistake is assuming adoption equals execution when the data model and control surfaces do not line up.

Technical breakdown

Why NIS2 turns identity governance into a regulated control

NIS2 expands the governance surface from basic security hygiene to demonstrable cyber-risk management. In practice, that means identity and access management must support approvals, revocation, risk assessment, and evidence of effective control operation. The directive’s logic is not that identities are a separate subject, but that access pathways are one of the clearest ways critical services fail. Once that becomes a statutory expectation, identity governance has to produce auditable outcomes, not just policy statements. Practical implication: treat identity governance as a compliance evidence chain, not only an access administration function.

Practical implication: Treat identity governance as a compliance evidence chain, not only an access administration function.

Access revocation and approval become compliance evidence

The article points to two controls that move from best practice into regulated expectation: removing access when employees or contractors no longer need it, and subjecting sensitive access to approval and risk analysis. Those are governance controls because they prove the organisation can limit standing exposure and enforce accountability. Generic accounts are especially problematic because they break the link between access and a named individual, which makes review and assignment harder to defend. Practical implication: prove that every high-risk entitlement has an owner, an approver, and a revocation path.

Practical implication: Prove that every high-risk entitlement has an owner, an approver, and a revocation path.

Zero trust and least privilege are now audit-relevant identity patterns

The article references the European Commission’s recommendation for zero-trust principles and identity and access management, with least-privilege access positioned as a core way to govern partners and contractors. In this context, zero trust is not a slogan; it is a design assumption that limits what any identity can do by default and forces continuous validation. For NIS2, that matters because broad or static access becomes harder to justify during assessments and management oversight. Practical implication: align privileged access design to least-privilege evidence, not convenience.

Practical implication: Align privileged access design to least-privilege evidence, not convenience.

NHI Mgmt Group analysis

NIS2 makes identity governance a regulatory control, not an optional programme discipline. The article is clear that access revocation, approval, risk analysis, and management oversight are now embedded in the compliance expectation for critical EU sectors. That shifts identity from an operational enabler to a measurable control surface. Practitioners should read NIS2 as a mandate to evidence governance outcomes, not merely document policy intent.

Generic accounts are a governance failure because they sever accountability from access. The article’s warning against accounts not tied to a named individual is not a housekeeping point; it is a direct challenge to auditability. When access cannot be attributed to a person, contractor, or role owner, approval and review lose force. The implication is that identity programmes need explicit ownership for every privileged path.

Access revocation latency is now a compliance risk pattern. SailPoint notes that many organisations still struggle to rescind access promptly when employees change roles or leave. That reveals a standing-access problem, not just a process gap. In a NIS2 context, delayed offboarding or mover handling becomes a control weakness that can be tied to regulatory exposure and breach impact.

Zero-trust identity design is becoming the practical language of NIS2 readiness. The directive’s emphasis on least privilege and identity and access management shows where governance and architecture meet. This is where the programme has to prove that partners, contractors, and internal users receive only the access needed for a bounded purpose. Practitioners should expect NIS2 evidence requests to focus on entitlement scope, not just policy existence.

Identity governance now spans human and non-human accounts under the same compliance pressure. The article explicitly notes the growing burden of managing identities for employees, partners, contractors, customers, devices, and bots. That breadth matters because the regulated problem is not just user access, but the overall identity estate that can create risk in critical services. The implication is that governance models must cover the full identity mix, not a human-only subset.

What this signals

Access governance has become a compliance boundary. NIS2 pushes IAM and IGA teams to prove that entitlement decisions are bounded, attributable, and reversible. In practical terms, the question is no longer whether access is controlled in policy, but whether the organisation can prove that control at audit time.

Identity programmes now need evidence across the full identity estate. The article’s reference to employees, contractors, partners, customers, devices, and bots shows why human-only governance is too narrow. Critical-sector organisations should expect NIS2 readiness to depend on whether their identity model covers every actor that can reach regulated systems.

For practitioners

• Tighten access revocation on joiner-mover-leaver events Confirm that role changes, contractor end dates, and leaver workflows actually remove access from sensitive applications and shared environments without manual delay.
• Eliminate generic and shared accounts Replace accounts that are not tied to a named individual with traceable identities so approvals, reviews, and accountability can be evidenced during NIS2 assessments.
• Require risk analysis for sensitive access approvals Make high-risk application and data access contingent on documented approval, entitlement scope, and a reviewable risk decision rather than default provisioning.
• Align management oversight to identity evidence Prepare senior-management reporting that shows who approved access, what was revoked, and how identity controls are being tested and measured against NIS2 obligations.

Key takeaways

• NIS2 changes identity governance from a support function into a regulated control area for critical EU organisations.
• The article cites 34% preparation completion across the UK, France, and Germany, alongside an IDSA survey in which 90% of companies reported an identity-related breach.
• The most material control themes are revocation, approval, risk analysis, named-account accountability, and management oversight.

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Credential Revocation: Credential revocation is the process of disabling a secret, token, or key so it can no longer authenticate or authorize action. It is the operational half of detection, because exposed credentials remain dangerous until they are invalidated and replaced across every dependent system.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
• Named Account: A named account is an identity that maps to one specific person or accountable actor rather than a shared or generic login. That traceability matters because approvals, reviews, and incident accountability depend on knowing exactly who the access belongs to and who is responsible for it.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.