Topic starter
20/08/2026 5:49 pm
TL;DR: NIS2 expands cybersecurity obligations beyond essential services to their suppliers, with senior management accountability, 24-hour reporting, and fines that can reach 2% of worldwide turnover, according to Expel. The directive turns access control, incident handling, and supply chain assurance into board-level governance issues, not optional controls.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Network and Information Security Directive (NIS2) compliance for businesses”.
By the numbers:
- The fines for essential entities can reach up to €10 million or 2% of worldwide annual turnover, depending on which is higher.
Key questions
Q: What breaks when access governance is weak under NIS2?
A: Weak access governance creates both security exposure and compliance failure.
Q: Why does NIS2 make supplier access a board-level issue?
A: Because the directive ties cybersecurity to management accountability, not just technical ownership.
Q: What are the signs that third-party access is too broad for NIS2 readiness?
A: Common warning signs include vendor accounts with persistent access, unclear ownership for service accounts, no documented offboarding, and incident logs that cannot identify which external identity performed an action.
Practitioner guidance
- Map all third-party access paths Inventory every supplier, managed service, and integration that can reach regulated systems, then assign a named business owner and technical custodian for each connection.
- Review non-human credentials used by vendors Identify API keys, tokens, service accounts, and certificates issued to external parties, then check scope, expiration, and offboarding status.
- Align incident reporting with identity evidence Ensure logs capture who or what authenticated, which privileges were used, and which systems were touched so 24-hour and 72-hour reporting can be completed accurately.
Bottom line: NIS2 turns third-party access into a regulated supply chain concern, so supplier identities now need the same governance discipline as internal accounts.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:29 pm
Supply chain trust has become an identity problem, not only a procurement problem. NIS2 matters because third-party access is now part of the regulated attack surface, and that means lifecycle control over supplier identities, service accounts, and delegated privileges is no longer optional. The directive effectively ties supplier assurance to access governance, which is where IAM and PAM teams already have the strongest leverage. Practitioner conclusion: treat every external access path as a governed identity relationship.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams respond when a supplier compromise exposes automation credentials?
A: Contain the affected trust path, revoke exposed secrets, confirm where the credentials were used, and force re-approval before any partner access resumes. The goal is to break reuse of the compromised identity, not just document the incident after the fact.
👉 Read our full editorial: NIS2 compliance is now a supply chain issue for critical services