NIS2 · Access governance
NIS2 access control.
From policy to evidence.
NIS2 includes access control in a broader cybersecurity programme. Establish which obligations apply, assign the people responsible and demonstrate that access decisions work in practice.
What the directive requires
Directive (EU) 2022/2555, Article 21, requires appropriate and proportionate technical, operational and organisational measures. Article 21(2)(i) includes human resources security, access control policies and asset management. Article 21(2)(j) covers multi-factor or continuous authentication, secured communications and emergency communications, where appropriate.
These provisions do not mandate an IGA product, a particular access-review frequency or a universal implementation deadline for an individual organisation. National implementing law and any applicable sector-specific rules determine the detailed obligations. Article 20 also gives management bodies approval, oversight and training responsibilities.
Check scope before choosing a tool
Start with the entity types and activities in Annexes I and II and Article 2. The general size rule refers to the EU definition of medium-sized enterprises or larger entities. Headcount alone, or a simple “€10 million turnover” test, is insufficient: financial criteria and partner or linked enterprises can matter. Some entity types and national designations apply regardless of size.
A customer’s contractual security requirements can affect a supplier without making that supplier directly subject to NIS2. Record direct legal scope and contractual duties separately. The national transposition deadline was 17 October 2024; check the law and authority responsible in each relevant Member State.
A practical control map
Connect each decision to evidence.
| Control objective | What to do | Evidence to retain |
|---|---|---|
| Access based on need | Define requestable access, owners, approval rules and expiry. | Approved policy, request, decision and target-system result. |
| Access remains appropriate | Review a risk-based scope and follow through on revocation decisions. | Reviewed population, reviewer, reason, exceptions and confirmed outcomes. |
| Leavers lose access | Connect authoritative departure events to revocation and verification. | Event time, execution result, outstanding systems and accountable owner. |
| Authentication protection | Configure appropriate authentication controls in the IdP and applications. | Configuration, coverage, exceptions and test results; an IGA approval is not MFA evidence. |
| Measures are effective | Test samples and investigate missing or stale data. | Test method, failures, corrective action and management oversight. |
Where easyIGA can help
easyIGA is the business-facing layer over midPoint. Its product scope covers requests, approvals, access reviews and connected evidence. Evaluate those workflows against your own systems and data: a successful approval is not proof of successful provisioning, and a missing last-use signal must remain unknown.
During a pilot, choose one application and a defined population. Demonstrate an approved request, a denied request, a leaver, a failed connector operation and a review decision that reaches the target. Check the export against the target-system record. Agree connector coverage and acceptance criteria before expanding.
IGA supports part of the programme. It does not replace incident response, business continuity, supply-chain risk management, staff training or management oversight. No easyIGA screen or export independently establishes NIS2 compliance.
Continue with the right level of detail
The full NIS2 guide explains scope, reporting and the limits of product claims. For financial-sector requirements, read DORA access management. For practical implementation, compare access reviews, audit evidence and deployment options.
Primary sources
- EUR-Lex: NIS2, Articles 2, 20, 21 and 41; Annexes I and II
- European Commission Recommendation 2003/361/EC: enterprise size and linked enterprises
Source review: 12 September 2026. EU-level information; assess your organisation under applicable national law.