NIS2 · Access governance # NIS2 access control. From policy to evidence. NIS2 includes access control in a broader cybersecurity programme. Establish which obligations apply, assign the people responsible and demonstrate that access decisions work in practice. [Read the detailed NIS2 guide](https://easyiga.com/blog/what-nis2-actually-requires) [Explore the evidence workflow](https://easyiga.com/demo) ## What the directive requires [Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng), Article 21, requires appropriate and proportionate technical, operational and organisational measures. Article 21(2)(i) includes human resources security, access control policies and asset management. Article 21(2)(j) covers multi-factor or continuous authentication, secured communications and emergency communications, where appropriate. These provisions do not mandate an IGA product, a particular access-review frequency or a universal implementation deadline for an individual organisation. National implementing law and any applicable sector-specific rules determine the detailed obligations. Article 20 also gives management bodies approval, oversight and training responsibilities. ## Check scope before choosing a tool Start with the entity types and activities in Annexes I and II and Article 2. The general size rule refers to the EU definition of medium-sized enterprises or larger entities. Headcount alone, or a simple “€10 million turnover” test, is insufficient: financial criteria and partner or linked enterprises can matter. Some entity types and national designations apply regardless of size. A customer’s contractual security requirements can affect a supplier without making that supplier directly subject to NIS2. Record direct legal scope and contractual duties separately. The national transposition deadline was 17 October 2024; check the law and authority responsible in each relevant Member State. ## Before your first review - Identify the legal entity, sector and jurisdiction. - List systems, owners and privileged access. - Agree approval and revocation responsibilities. - Record exceptions and remediation owners. - Test the actual target-system outcome. For national scope, use the applicable law and competent authority. This page explains the EU framework and a practical access-governance approach. A practical control map ## Connect each decision to evidence. Access-governance examples; these are implementation suggestions, not verbatim statutory requirements. | Control objective | What to do | Evidence to retain | Access based on need | Define requestable access, owners, approval rules and expiry. | Approved policy, request, decision and target-system result. | Access remains appropriate | Review a risk-based scope and follow through on revocation decisions. | Reviewed population, reviewer, reason, exceptions and confirmed outcomes. | Leavers lose access | Connect authoritative departure events to revocation and verification. | Event time, execution result, outstanding systems and accountable owner. | Authentication protection | Configure appropriate authentication controls in the IdP and applications. | Configuration, coverage, exceptions and test results; an IGA approval is not MFA evidence. | Measures are effective | Test samples and investigate missing or stale data. | Test method, failures, corrective action and management oversight. ## Where easyIGA can help easyIGA is the business-facing layer over midPoint. Its product scope covers requests, approvals, access reviews and connected evidence. Evaluate those workflows against your own systems and data: a successful approval is not proof of successful provisioning, and a missing last-use signal must remain unknown. During a pilot, choose one application and a defined population. Demonstrate an approved request, a denied request, a leaver, a failed connector operation and a review decision that reaches the target. Check the export against the target-system record. Agree connector coverage and acceptance criteria before expanding. IGA supports part of the programme. It does not replace incident response, business continuity, supply-chain risk management, staff training or management oversight. No easyIGA screen or export independently establishes NIS2 compliance. ## Continue with the right level of detail The [full NIS2 guide](https://easyiga.com/blog/what-nis2-actually-requires) explains scope, reporting and the limits of product claims. For financial-sector requirements, read [DORA access management](https://easyiga.com/dora). For practical implementation, compare [access reviews](https://easyiga.com/product/access-reviews), [audit evidence](https://easyiga.com/product/audit-evidence) and [deployment options](https://easyiga.com/deployment). ## Primary sources - [EUR-Lex: NIS2, Articles 2, 20, 21 and 41; Annexes I and II](https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng) - [European Commission Recommendation 2003/361/EC: enterprise size and linked enterprises](https://eur-lex.europa.eu/eli/reco/2003/361/oj/eng) Source review: 12 September 2026. EU-level information; assess your organisation under applicable national law.