Topic starter
26/08/2026 11:51 am
TL;DR: NIS2 shifts cybersecurity from an IT concern to a board-accountable business risk, and Wallix’s interview argues that access governance now sits at the centre of resilience because excessive privileges, shared accounts, and poor traceability undermine both prevention and investigation. The pressure point is not just compliance, but accountable control over who can access what, when, and under what oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Wallix: “EXPERT INTERVIEW :”.
Key questions
Q: What breaks when shared admin accounts are still used under NIS2?
A: Shared admin accounts break accountability because multiple people can act through the same credential, making it difficult to prove who did what.
Q: Why does NIS2 make third-party access a governance issue?
A: Because NIS2 expects organisations to control risk across their supply chain, not just inside the enterprise boundary.
Q: How can organisations improve traceability when legacy systems do not support modern access models?
A: They can place those systems behind privileged access management, stronger authentication, and auditable access paths.
Practitioner guidance
- Treat access governance as a board risk metric Build reporting that shows privilege concentration, shared account usage, third-party access scope, and traceability gaps in language leadership can act on.
- Replace shared admin credentials with named accountability Move older systems toward named individual accounts wherever the application allows it, and document exceptions where it does not.
- Wrap legacy access in PAM controls Use privileged access management to add approval, session oversight, and audit trails around unavoidable shared or elevated access paths.
Bottom line: NIS2 pushes access governance into the centre of resilience because boards are now accountable for how privilege is granted, used, and reviewed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
NIS2 turns access governance into a board accountability problem, not an IAM housekeeping task. The interview is clear that cybersecurity is now treated as business risk, which means the board must understand access posture as part of resilience oversight. That shift changes the status of privilege management, traceability, and third-party access from operational concerns to governance evidence. Practitioners should expect access decisions to be reviewed through accountability, not just technical correctness.
A question worth separating out:
Q: How should organisations govern privileged access under NIS2?
A: They should treat privileged access as a resilience and accountability control, not just a technical permission set. That means naming owners, enforcing approvals, time-bounding access, and preserving logs that let investigators reconstruct who did what, when, and under whose authority. If those elements are missing, compliance evidence will be weak and incident response will be slow.
👉 Read our full editorial: NIS2 makes access governance a board-level accountability issue