Topic starter
25/06/2026 1:07 am
TL;DR: NIS2 pushes critical infrastructure operators toward passwordless access, because username and password controls remain exposed to phishing, reuse, and disruption in regulated environments, according to RSA Security. The real issue is that access assurance now has to survive suppliers, contractors, and legacy systems without relying on static credentials.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Securing Europe’s Critical Infrastructure in the NIS2 Era: Why Passwordless Identity Security Matters”.
Key questions
Q: What breaks when critical infrastructure still relies on passwords under NIS2?
A: Reusable passwords leave critical infrastructure exposed to phishing, reuse, and credential interception, so the access decision can be defeated before the user reaches the application.
Q: Why do passwords create more risk in supplier and contractor access?
A: Suppliers and contractors often need access from different devices, locations, and lifecycle states than employees, yet password-based governance treats them as if they were the same.
Q: When should organisations prioritise pilot groups and early adopters in a passwordless rollout?
A: They should do it at the start, before broad deployment.
Practitioner guidance
- Map critical access paths to password exposure Identify which operational accounts, supplier logins, and contractor pathways still depend on reusable passwords, then rank them by business criticality and exposure to phishing or reuse.
- Phase in phishing-resistant authentication Prioritise FIDO2 hardware keys, mobile biometrics, or equivalent phishing-resistant methods for privileged and high-impact access before expanding to lower-risk workflows.
- Separate third-party access governance Apply distinct enrolment, recovery, and assurance rules for suppliers and contractors so their access does not inherit employee assumptions about device trust or lifecycle handling.
Bottom line: Password-based access remains a poor fit for regulated critical infrastructure because it is easy to phish, reuse, and scale into disruption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:19 am
Password reliance is now an access-governance liability in critical infrastructure. NIS2 pushes the control discussion beyond login convenience and into resilience, because passwords are both human-dependent and easy to abuse at scale. In regulated sectors, that makes them a poor foundation for high-impact access paths. The practitioner conclusion is straightforward: if the access model still depends on reusable secrets, the governance model is already behind the regulatory demand.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Why do remote workforce environments increase the need for Zero Trust and passwordless access?
A: Remote work expands the number of devices, applications, and third parties that must be trusted across distributed environments. That increases exposure if access decisions rely on static credentials or fragmented controls. Zero Trust and passwordless approaches reduce dependency on passwords, limit implicit trust, and help organizations verify users more consistently across cloud and remote access paths.
👉 Read our full editorial: Passwordless identity security for NIS2 critical infrastructure access