Notifications
Clear all
Topic starter
11/07/2026 1:56 pm
TL;DR: NIS2 shifts compliance from control checklists to provable resilience, executive accountability, and containment, according to Zero Networks. The directive’s practical test is whether organisations can limit damage when controls fail, not whether they can claim controls exist on paper.
NHIMG editorial — based on content published by Zero Networks: The CISO’s Guide to NIS2 Compliance
By the numbers:
- Just 1% of ports account for 90% of breaches, but most organizations leave privileged admin ports like SSH, RDP, and RPC open permanently.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when NIS2 is treated as a checkbox compliance exercise?
A: The programme breaks at the point where controls are assumed to equal resilience.
Q: Why do standing privileged paths create NIS2 risk?
A: Standing privileged paths matter because they turn a local compromise into a continuity problem.
Q: What do security teams get wrong about third-party access under NIS2?
A: They often treat vendor access as a connectivity issue instead of a governance issue.
Practitioner guidance
- Map privileged paths to containment outcomes Identify SSH, RDP, RPC, vendor VPN, and other high-risk routes, then document how each path is blocked, limited, or isolated when an incident occurs.
- Convert standing privilege into conditional access Replace always-on administrative reach with just-in-time elevation and explicit path approval, including service accounts that currently bypass normal review.
- Segment third-party and supplier access by asset need Remove broad remote access patterns and define which internal systems each external identity can reach, with containment boundaries enforced at the network layer.
What's in the full article
Zero Networks' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step guidance on preventing lateral movement with microsegmentation and identity-aligned network controls.
- Practical examples of just-in-time MFA for privileged ports, including service accounts and legacy environments.
- Checklist questions for validating whether containment is built into the environment rather than added after detection.
- A compliance-oriented view of how to evidence blast-radius reduction for NIS2 stakeholders.
👉 Read Zero Networks' guide to NIS2 compliance and resilience →
NIS2 compliance: what changes for resilience, access, and containment?
Explore further
11/07/2026 2:05 pm
Blast-radius control is now the real compliance unit under NIS2. The directive is written around continuity and demonstrable containment, not around the fiction that every control will hold. That means the programme is being judged by how far an incident can travel once something fails, which elevates identity pathing and segmentation into board-level governance. Practitioners should treat containment evidence as the compliance artefact, not just policy documentation.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs , Key Challenges and Risks.
A question worth separating out:
Q: Who is accountable when a NIS2-relevant incident spreads through legacy systems?
A: Accountability sits with the organisation that allowed unmanaged privilege to persist around the legacy environment. If a system cannot support modern identity controls, the compensating controls and containment boundaries still need clear ownership. NIS2 is concerned with whether the business can prove control over impact, not whether the asset is old.
👉 Read our full editorial: NIS2 compliance demands resilience, not checkbox security
