Notifications
Clear all
Topic starter
24/06/2026 7:28 pm
TL;DR: NIS2 now drives active supervision, broader scope, tighter incident reporting, and senior-management accountability for an estimated 160,000 European companies, according to Collibra. That shifts identity governance from periodic compliance checks to continuous access control, lineage, and evidence generation across data, machine, and service identities.
NHIMG editorial — based on content published by Collibra: How the NIS2 Directive is redefining data intelligence and security
Questions worth separating out
Q: How should organisations apply NIS2 to data access governance?
A: Organisations should treat NIS2 as a requirement for continuous access control, not a periodic compliance exercise.
Q: Why do service accounts and machine identities matter under NIS2?
A: Service accounts and machine identities matter because they often carry the permissions that move data, trigger reports, and feed AI workflows.
Q: What breaks when lineage and access controls are not connected?
A: Incident response slows down because teams cannot quickly show which systems, reports, or models were affected by a compromise.
Practitioner guidance
- Build a NIS2 evidence chain for every sensitive data path Document who can reach the data, which downstream reports or models it feeds, what policy justified the access, and where audit evidence is stored.
- Bring machine and service accounts into access review cycles Include non-human identities in the same review, revocation, and exception-handling workflow as human users.
- Define ownership for data access decisions and incident response Assign a named owner for each critical data domain, then require that owner to validate policy, lineage, and reporting evidence before an audit or incident.
What's in the full article
Collibra's full blog post covers the operational detail this post intentionally leaves for the source:
- The article's full breakdown of NIS2 compliance workflow stages, including assessment, remediation, and continuous monitoring
- Operational detail on data lineage, access review, and policy enforcement inside Collibra Data Access
- The article's treatment of accountability, stewardship, and how the platform ties governance records to regulatory evidence
- Specific examples of how Collibra maps data, AI, and security teams into a single compliance workflow
👉 Read Collibra's analysis of how NIS2 is reshaping data access governance →
NIS2 data access governance: are your controls keeping up?
Explore further
25/06/2026 4:46 am
NIS2 is pushing identity governance from periodic review to continuous proof. The directive's enforcement posture means organisations can no longer rely on annual attestations or after-the-fact justification. Access must be observable, revocable, and evidentially defensible at all times. That shifts identity governance from an administrative function into an operational control surface, and practitioners should treat evidence readiness as part of access design.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable for NIS2 access decisions and incident reporting?
A: Top-level management remains accountable for risk governance, but identity, data, and security teams must supply the evidence and control operations that make accountability real. Practically, that means clear ownership for access policy, review outcomes, incident scope, and reporting artefacts. Without named stewardship, the organisation cannot demonstrate control.
👉 Read our full editorial: NIS2 is reshaping data access governance for identity teams
