Topic starter
10/07/2026 9:21 pm
TL;DR: NIS2, ENS and ISO 27001 increasingly demand demonstrable, continuous control over access, not just policy documentation or periodic reviews, according to Soffid. The governance gap is that many IAM programmes still certify access on a schedule while regulators and auditors expect evidence that permissions are current, justified and enforceable.
Editorial analysis by NHI Mgmt Group, based on content published by Soffid: “IAM Compliance: control continuo para NIS2 y ENS”.
Key questions
Q: What breaks when identity compliance is still handled through periodic IAM reviews?
A: Periodic IAM reviews break down when access changes faster than certification cycles and evidence is scattered across systems.
Q: Why do NIS2 and ENS push IAM programmes toward continuous evidence rather than policy documents?
A: Because these frameworks are applied in contexts where organisations must demonstrate that access controls are operating, not merely described.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Define continuous control as an identity requirement Translate regulatory expectations into measurable IAM outcomes such as current entitlement status, provable justification and enforceable revocation.
- Unify IGA, IAM and PAM evidence Ensure identity creation, access approval, privileged elevation and revocation all write to the same governance record so auditors can trace one control story from request to enforcement.
- Automate recertification as a live control Move review cycles into the normal identity workflow so permissions are revalidated continuously rather than left until the next scheduled campaign.
Bottom line: IAM compliance is shifting from scheduled review to continuous proof of current access control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:43 pm
Continuous access control is now the compliance baseline, not an advanced maturity marker. NIS2, ENS and ISO 27001 are pulling IAM out of the policy-documentation era and into evidence-driven governance. The relevant question is no longer whether an access review exists, but whether the organisation can prove access was justified, current and enforceable when it mattered. For practitioners, this means compliance has become an operational control problem, not a paperwork problem.
A question worth separating out:
Q: Which framework alignment matters most for access control evidence in regulated environments?
A: NIST CSF access permissions and authorisations, IAM lifecycle discipline and regulated-sector requirements all matter, but the key test is whether the organisation can demonstrate live control over entitlements rather than rely on review reports alone.
👉 Read our full editorial: IAM compliance for NIS2 and ENS needs continuous control