Notifications
Clear all
Topic starter
25/06/2026 5:19 pm
TL;DR: NIS2 pushes organisations to treat identity security as a core compliance control, with SailPoint arguing that identity contributes to five of the directive’s ten pillars, including supply chain security, access control and cyber hygiene. The practical conclusion is that access visibility, privileged account control and toxic entitlement remediation now sit inside regulatory risk management, not beside it.
NHIMG editorial — based on content published by SailPoint: Pillars of the NIS2 Directive: Recommended risk management measures
By the numbers:
- This type of attack on the supply chain is 40% more frequent than malware or ransomware attacks.
Questions worth separating out
Q: How should organisations map identity security to NIS2 compliance?
A: Start by linking identity controls to the directive’s risk pillars, especially access control, supply chain security, cyber hygiene and governance evidence.
Q: Why do supplier identities create so much NIS2 compliance risk?
A: Supplier identities often have legitimate access but weaker governance than internal users, which makes them easy to overlook in lifecycle reviews and offboarding.
Q: How do security teams prove that identity controls are actually reducing risk?
A: Use posture indicators that show whether accounts are shared, orphaned, over-privileged, disabled late or carrying toxic entitlement combinations.
Practitioner guidance
- Map identity controls to the NIS2 risk pillars Tie named accounts, privileged access, supplier access, cyber hygiene and access review evidence back to the directive’s risk areas so compliance can be demonstrated with control outcomes rather than policy statements.
- Extend governance to third-party identities Bring suppliers, consultants, contractors and partners into the same approval, recertification and offboarding process used for internal accounts, with explicit access expiry and ownership.
- Build identity posture indicators Track orphaned accounts, shared accounts, disabled status failures, high privilege and toxic entitlement buildup so remediation can be prioritised before audit findings or incidents expose the gaps.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- The article’s breakdown of the ten NIS2 pillars and where identity security maps to each one.
- Examples of identity policy language such as named accounts, privileged access and least privilege in the NIS2 context.
- The posture indicators SailPoint highlights for accounts without owners, shared access and toxic entitlement accumulation.
- The article’s reference links to related NIS2 compliance posts for teams building an implementation plan.
👉 Read SailPoint’s analysis of identity security and NIS2 compliance pillars →
NIS2 and identity control: what IAM teams need to tighten now?
Explore further
25/06/2026 5:55 pm
NIS2 makes identity control an evidentiary requirement, not a side effect of access management. The article is right to treat identity security as foundational because the directive’s risk pillars cannot be met with policy language alone. If an organisation cannot show control over who has access, what kind of access they hold and whether that access is still justified, it cannot credibly claim compliance. The implication is that identity governance becomes part of the compliance record, not just the security stack.
A few things that frame the scale:
- From our research: 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who is accountable when third-party access causes a NIS2 problem?
A: Accountability sits with the organisation that granted the access and failed to govern it, even if a supplier or contractor was the immediate user. The practical test is whether the access was owned, reviewed, time-bounded and removed when the relationship changed. If those answers are unclear, governance ownership is also unclear.
👉 Read our full editorial: NIS2 compliance depends on identity control, not checkbox governance
