NIS2 compliance: Fixing IAM and access control before the 2026 audit
EU NIS2 enforcement deadlines approach; organizations are urged to prioritize service account inventory, lifecycle offboarding, and phishing-resistant MFA before audits.
EU member states are moving from NIS2 transposition into enforcement, with fines up to 10 million euros or 2% of global turnover for essential entities and personal liability for management bodies. The article argues access management is the fastest high-ROI starting point, estimating 2-4 weeks to enforce fine-grained password policy, vault shared credentials, and deploy phishing-resistant MFA versus 6-12 months for supply chain risk management. It flags three common pre-audit failures: unmanaged service accounts and API keys, dormant accounts from broken offboarding, and SMS OTP instead of phishing-resistant MFA under NIST SP 800-63B. The piece promotes Passwork as a single control plane for credential storage, RBAC, and WebAuthn.
- NIS2 fines reach 10M euros or 2% of turnover for essential entities, with board personal liability
- Credential abuse appears in 39% of breaches across the full attack chain per Verizon DBIR
- Service accounts, API keys, and dormant accounts are common Article 21 audit failures
- NIST classifies SMS OTP as restricted; FIDO2/WebAuthn expected for privileged access
- Access control enforcement takes 2-4 weeks versus 6-12 months for supply chain management
- Vendors
- Passwork
From the original article
6 min read at helpnetsecurity.com
The NIS2 Directive places direct obligations on organizations across supply chain risk management, incident reporting, and board-level accountability. October brings a new wave of legally binding deadlines across the EU, as member states move from transposition into enforcement.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.