Notifications
Clear all
Topic starter
10/07/2026 9:23 pm
TL;DR: NIS2 and the EU’s implementing rules elevate qualified trust service providers into a stricter risk, incident, supply chain, and board-accountability model that affects digital trust operations across the Union, according to Vintegris. For IAM and identity assurance teams, this is a governance shift: compliance now depends on lifecycle control, transparent reporting, and resilience rather than certificate handling alone.
NHIMG editorial — based on content published by Vintegris: Directiva NIS 2 y QTSP and the new paradigm of digital trust in the European Union
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How should organisations govern QTSP risk under NIS2?
A: Organisations should govern QTSP risk as a critical service, not a narrow compliance task.
Q: Why do supply chain dependencies matter so much for digital trust services?
A: Supply chain dependencies matter because digital trust services inherit risk from every upstream component they rely on.
Q: What do security teams get wrong about compliance for trust service providers?
A: Teams often treat compliance as evidence that the service is inherently resilient.
Practitioner guidance
- Map trust-service dependencies end to end Document every upstream provider, hosting layer, and delegated component that affects signing, authentication, or certificate assurance.
- Translate incident obligations into a reporting runbook Define what counts as a significant incident, who approves notification, what evidence is required, and how quickly external stakeholders are informed.
- Extend supply chain controls to trust operations Apply third-party assurance reviews, contract clauses, and periodic validation to all critical providers supporting trust services.
What's in the full article
Vintegris's full analysis covers the operational detail this post intentionally leaves for the source:
- How Vintegris maps NIS2 obligations into its SGSI operating model and service controls.
- The certification and continuity stack behind nebulaSUITE, including ISO 27001 and ISO 22301 context.
- The article's view of how regulated trust services should communicate incidents and resilience to customers.
- The practical implications of NIS2 for customers relying on qualified trust services in the EU.
👉 Read Vintegris's analysis of NIS2 and QTSP governance in the EU →
NIS2 and QTSPs: what changes for digital trust teams now?
Explore further
10/07/2026 9:45 pm
NIS2 turns digital trust providers into governance-critical infrastructure, not just technical intermediaries. For QTSPs, that means assurance now has to be demonstrated across incident handling, supplier oversight, and executive accountability, not only through certificate operations. The regulatory shift is less about adding paperwork and more about proving that trust services can survive disruption. Practitioner conclusion: identity and trust teams should treat QTSP governance as critical infrastructure management.
A question worth separating out:
Q: Who is accountable when a qualified trust service fails?
A: Accountability sits with management, not only the engineering or security team. NIS2 shifts the burden toward leadership bodies that must ensure controls, reporting, and oversight are in place before failure occurs. If the service is essential to trust and authentication, then governance must be visible at executive level.
👉 Read our full editorial: NIS2 reshapes QTSP governance and digital trust in the EU
