NIS2: what the directive really changes for your IAM
MFA, access management, privileged accounts: NIS2 makes IAM a governance obligation, all the way up to senior management.
The NIS2 directive considerably widens the number of organisations in scope across the European Union: thousands of essential and important entities, public and private. Among the expected measures, identity and access management plays a central role.
Requirements that directly affect IAM
Article 21 of the directive lists the cybersecurity risk-management measures. Several are directly IAM-related:
- Access control policies and asset management.
- Multi-factor or continuous authentication where appropriate.
- HR security: entitlements aligned with the Joiner-Mover-Leaver lifecycle.
- Cyber hygiene: control of privileged accounts and administrative access.
Accountability goes up to the board
NIS2 makes management bodies accountable: they must approve and oversee cybersecurity measures. For IAM, this means readable indicators: MFA coverage, orphaned accounts, revocation times, access review results.
Where to start
An IAM maturity assessment mapped against NIS2 measures and national guidance quickly identifies priority gaps and produces a realistic roadmap.
We handle this in the field
- We run IAM maturity audits aligned with NIS2 and national security agency guidance.
- We roll out MFA across the board and secure administrative access (bastion, PAM).
- We automate Joiner-Mover-Leaver processes and deliver the KPIs your board expects.
Got a technical question on this topic? Our experts will be glad to help you find the answer.