Topic starter
25/06/2026 1:31 am
TL;DR: NIS2 raises the bar for identity governance across EU critical sectors, with SailPoint citing that only 34% of organisations in the UK, France and Germany had completed preparations and 90% of companies in an IDSA survey reported an identity-related breach. The directive makes access revocation, approval, risk analysis, and senior-management oversight core control expectations, not optional hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Foot to the floor: what NIS2 means for your business”.
By the numbers:
- Only 34% of organisations across the UK, France and Germany had completed preparations for NIS2, according to SailPoint research.
- 90% of companies in an IDSA survey said they had an identity-related breach in the past year, according to SailPoint's article.
- NIS2 non-compliance can cost up to €10 million or 2% of global annual revenue, according to SailPoint.
Key questions
Q: What breaks when access governance is weak under NIS2?
A: Weak access governance creates both security exposure and compliance failure.
Q: Why does NIS2 make access revocation and approval more important?
A: Because NIS2 treats them as part of the security measures that critical entities must be able to show in operation.
Q: How should security teams prepare identity controls for NIS2 audit scrutiny?
A: Teams should make access lifecycle evidence retrievable by design.
Practitioner guidance
- Tighten access revocation on joiner-mover-leaver events Confirm that role changes, contractor end dates, and leaver workflows actually remove access from sensitive applications and shared environments without manual delay.
- Eliminate generic and shared accounts Replace accounts that are not tied to a named individual with traceable identities so approvals, reviews, and accountability can be evidenced during NIS2 assessments.
- Require risk analysis for sensitive access approvals Make high-risk application and data access contingent on documented approval, entitlement scope, and a reviewable risk decision rather than default provisioning.
Bottom line: NIS2 changes identity governance from a support function into a regulated control area for critical EU organisations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:59 am
NIS2 makes identity governance a regulatory control, not an optional programme discipline. The article is clear that access revocation, approval, risk analysis, and management oversight are now embedded in the compliance expectation for critical EU sectors. That shifts identity from an operational enabler to a measurable control surface. Practitioners should read NIS2 as a mandate to evidence governance outcomes, not merely document policy intent.
A question worth separating out:
Q: What do security teams get wrong about Zero Trust and identity governance?
A: They often treat Zero Trust as an integration label rather than a continuous operating requirement. If identity signals are inconsistent across tools, the organisation may enforce local checks while still lacking enterprise-wide assurance. The mistake is assuming adoption equals execution when the data model and control surfaces do not line up.
👉 Read our full editorial: NIS2 turns identity governance into a compliance requirement