How should hospitals evidence privileged and emergency access for NIS2 inspections?

What Hospitals Need to Show During a NIS2 Inspection

Hospitals need to demonstrate that privileged and emergency access is controlled, attributable, and reviewable. In practice, that means evidence must show separate privileged accounts, emergency use with a recorded business reason, and post-event review. For NIS2, the inspection question is not whether emergency access exists, but whether the organisation can reconstruct each exception and prove it stayed within policy.

A useful way to think about the control is that inspectors will test the evidence chain, not just the policy statement. If a hospital can only say “we have break-glass access,” but cannot show who activated it, when, from which account, and under what approval or justification, the control is weak even if the technical mechanism works.

That is why privileged access and emergency access should be treated as distinct audit objects. Privileged access covers routine elevated administration; emergency access covers exceptional use when normal access is unavailable or too slow. The evidence set should let a supervisor distinguish those cases without relying on memory or informal explanations.

Which Artefacts Make Emergency Access Reconstructable?

The most persuasive evidence is a joined set of account, log, and review records. Hospitals should be able to show the privileged account inventory, the break-glass or emergency account register, authentication or session logs, and the review record that confirms the event was legitimate. A clean policy without these artefacts leaves an inspection gap because the control cannot be replayed after the fact.

Logs should be specific enough to answer four basic questions: who used access, what system or function was reached, why the exception was needed, and how long the elevated access remained active. Session records are especially valuable where privileged actions can change patient systems, identity systems, or clinical platforms, because they show the actual administrative behaviour rather than only the login event.

The review record matters as much as the activation record. Inspectors will often look for evidence that break-glass use was examined promptly, exceptions were challenged where appropriate, and any excessive or repeated use was escalated. If the hospital cannot show a consistent review cadence, emergency access starts to look like standing privilege with a different name.

How Hospitals Should Organise the Control for Audit Readiness

Inspection-ready access control works best when routine administration and emergency administration are separated in both design and evidence. Separate privileged accounts reduce ambiguity, and time-bounded emergency access makes it easier to prove the exception was temporary. Hospitals should align the control to the actual operational workflow, including out-of-hours support, clinical urgency, and remote administration, rather than assuming one generic admin model fits every system.

This is also where supervision and ownership matter. The evidence should show that emergency access is not owned only by infrastructure teams, but is visible to security, audit, and system owners. If the process spans multiple platforms, the hospital should be able to demonstrate a consistent chain across directory services, PAM, and the target application or infrastructure layer.

For organisations building that evidence path, NHIMG’s Identity Security Regulatory Map is useful for mapping identity controls to NIS2 and related obligations, while the Break-Glass and Emergency Access Account Guide shows how to design and monitor emergency access accounts so they remain auditable.

Risk and Threat Considerations

Emergency access becomes a control weakness when it is easy to invoke but hard to explain. In a hospital, that creates exposure not only to inspection failure, but also to misuse by insiders, shared-account practices, and poorly governed vendor access. The risk is highest when break-glass credentials are long-lived, rarely tested, or used as a substitute for proper privileged access design.

Failure mechanism: The control fails when access is activated outside normal governance but the hospital cannot tie that event to a named person, a legitimate reason, and a bounded duration. That usually happens when logs are fragmented, accounts are shared, or post-event review is informal.

Impact: The hospital may be unable to prove compliance during a NIS2 inspection, and it may also lose the ability to distinguish legitimate emergency use from privilege abuse or account compromise. In a clinical environment, that weak evidence can also delay containment decisions after a real incident.

Practitioner Guidance

What to verify: Confirm that every privileged and emergency access path is separately inventoried, time-stamped, and tied to a named owner or approver. The minimum test is whether an auditor could reconstruct the event from the records without interviewing the operator.

Common mistake: Treating “break-glass exists” as sufficient evidence. A working emergency path is only half the control; without review records and reason codes, the hospital cannot show the exception stayed inside policy.

What good looks like: A small set of tightly governed privileged accounts, alerting on every emergency activation, and a routine review pack that records reason, scope, duration, and outcome. Where emergency access is repeated, the control should trigger redesign, not just another approval.

Practitioner takeaway: For NIS2, the question is not whether hospitals can emergency-access critical systems, but whether they can prove every exception was intentional, time-bounded, and independently reviewable.

Related resources from NHI Mgmt Group

• How should security teams run access reviews for non-human identities?
• How should security teams govern non-human identities that have persistent access?
• When do NHI access reviews create more value than a one-time cleanup?
• What is the difference between reviewing human access and reviewing NHIs?