Background
From recommendation to legal requirement
NIS2 is the EU's cybersecurity directive, and it expands the circle of covered organizations considerably compared with the original NIS directive – from energy, transport, and finance to sectors such as food, waste management, manufacturing, and digital services. After several delays, the Danish implementation entered into force in 2025, and supervision of the covered sectors is under way.
Two things set NIS2 apart from earlier regulation: management liability – the management body must approve the risk management measures itself and cannot delegate the responsibility away – and penalties that carry real weight. Cybersecurity has moved from the IT department to the boardroom.
What does NIS2 require of access management?
Article 21 of the directive lists the minimum measures every covered organization must have in place. Several of them concern identities and access directly: access control policies, asset management, the use of multi-factor authentication, and human resources security, that is, the processes around hiring, role changes, and departures.
What the requirements have in common is that a policy sitting in a folder is not enough. You must be able to document that the controls work in practice: Who has access to what? Why do they have it? And when was it last reviewed?
Checklist
Five questions you must be able to answer
- Overview: can you produce a current list of who has access to your critical systems?
- Lifecycle: is access closed automatically when an employee leaves or changes role?
- Approval: is there a documented owner and approver behind every access assignment?
- Review: do you review and recertify access at fixed intervals?
- Privileged accounts: are administrator accesses mapped, restricted, and monitored?
This is where IGA comes in
In a small organization, you may be able to answer yes to these questions with manual processes and discipline. But manual processes are hard to document over time, and documentation is exactly what supervisors and auditors ask for.
This is where Identity Governance & Administration (IGA) comes in. An IGA solution automates on-, re-, and offboarding based on HR data, enforces approval flows, and produces the documentation as a by-product of daily operations – instead of as firefighting ahead of an audit.
Where do you stand on NIS2?
Our IAM Maturity Assessment gives you a documented picture of your access management – and a roadmap for what to lift first.
