Compliance
From regulation to verifiable access governance
NIS2, DORA, ISO 27001, and GDPR all ask the same fundamental question: can you document who has access to what – and that the access is justified? We translate the requirements into concrete IAM controls and help you close the gaps in priority order.
The value
Compliance isn't just a requirement – it's a competitive advantage
Reduced risk
Controlled access and protected privileged accounts shrink both the attack surface and the damage potential.
Efficient on- and offboarding
Automated processes remove both the waiting time at hiring and the forgotten access at departure.
Better user experience
SSO and modern MFA make the secure path the easy path.
Stronger governance
Recertification and an audit trail turn the audit into a report – not a project.
NIS2
How IAM supports your NIS2 obligations
NIS2 makes access governance a management responsibility. The table shows where the three IAM disciplines carry the requirements.
| Requirement area | IGA | PAM | AM |
|---|---|---|---|
| Access control policies (art. 21) | ✓ | ✓ | ✓ |
| Management of user accounts and entitlements | ✓ | – | – |
| Protection of privileged accounts | – | ✓ | – |
| Multi-factor authentication | – | – | ✓ |
| Documentation and reporting to management | ✓ | ✓ | – |
| Incident handling (tracing access) | ✓ | ✓ | ✓ |
IGA = Identity Governance & Administration · PAM = Privileged Access Management · AM = Access Management.
Our view
Nobody becomes compliant from a report. You become compliant from processes that run when nobody is watching.
So we translate the requirements into controls you can document every month, rather than into a gap analysis that gathers dust until the next audit.
DORA
IAM controls in DORA for the financial sector
| Requirement area | IGA | PAM | AM |
|---|---|---|---|
| Management of access rights (art. 9) | ✓ | – | – |
| Least privilege and segregation of duties | ✓ | ✓ | – |
| Privileged access to critical systems | – | ✓ | – |
| Strong authentication | – | – | ✓ |
| Periodic access reviews (recertification) | ✓ | – | – |
| Traceability and audit documentation | ✓ | ✓ | – |
ISO 27001
Access controls in ISO 27001 (Annex A)
| Control area | IGA | PAM | AM |
|---|---|---|---|
| A.5.15 Access control | ✓ | – | ✓ |
| A.5.16 Identity management | ✓ | – | – |
| A.5.17 Authentication information | – | ✓ | ✓ |
| A.5.18 Access rights (granting and removal) | ✓ | – | – |
| A.8.2 Privileged access rights | – | ✓ | – |
| A.8.5 Secure authentication | – | – | ✓ |
CIS Controls
Identity and access in CIS Controls v8.1
CIS Controls is not a legal requirement but a voluntary framework many use to prioritize the work. The identity-related safeguards sit together in Control 5 and 6.
| Safeguard | IGA | PAM | AM |
|---|---|---|---|
| 5.1 Inventory of accounts, including administrator and service accounts | ✓ | – | – |
| 5.3 Disable dormant accounts | ✓ | – | – |
| 5.4 Administrator privileges on dedicated accounts | – | ✓ | – |
| 5.5 Inventory of service accounts | ✓ | ✓ | – |
| 6.1 and 6.2 Processes for granting and revoking access | ✓ | – | – |
| 6.3–6.5 MFA for externally-exposed apps, remote access and administrative access | – | ✓ | ✓ |
| 6.7 Centralized access control through a directory service or SSO | – | – | ✓ |
| 6.8 Role-based access control and periodic review | ✓ | – | – |
Safeguard numbers and titles follow CIS Controls v8.1 (June 2024), the current release.
Compliance Check
From analysis to implementation – we guide you all the way
Our Compliance Check is a well-defined advisory engagement that makes the requirements concrete.
- Review
We review your current IAM setup – processes, technology, and documentation.
- Gap mapping
Your setup is measured against the requirements of NIS2, GDPR, ISO 27001, and/or DORA – where they touch identity and access.
- Prioritized roadmap
An action plan in priority order: what closes the biggest risks first, and what can wait.
Are you ready for the next audit?
Book a no-obligation conversation about where regulation touches your access governance – and what should be closed first.