The NIS2 Directive is imposing new, legally binding cybersecurity obligations on organizations across the European Union, with member states now moving from transposition into enforcement. Compliance deadlines are approaching, with national implementation laws coming into force and mandatory self-registration periods closing. Non-compliance can lead to significant penalties, including fines up to €10 million or 2% of global turnover for essential entities, and personal liability for management bodies, potentially including temporary bans from executive roles.
While NIS2 covers a broad range of requirements, including supply chain risk management and incident reporting, experts suggest that focusing on access management and credential hygiene offers a high return on investment for compliance efforts. Implementing robust access controls can be achieved in a matter of weeks, compared to the months required for other areas like supply chain risk management. This approach not only generates immediate auditable evidence but also addresses critical attack vectors.
Despite the Verizon Data Breach Investigations Report (DBIR) indicating that vulnerability exploitation was the leading initial access vector in 2026, accounting for 31% of breaches, credential abuse remains a significant threat throughout the entire attack chain, appearing in 39% of all breaches. Attackers frequently use compromised credentials to move laterally within a network after initial access.
Several common access management gaps are identified as frequent points of failure in pre-audits. One critical area is the management of non-human identities, such as service accounts and API keys. These credentials, which often outnumber human accounts in mid-sized organizations, are frequently unmanaged, sharing passwords that are rarely rotated and lacking documented ownership. They are often found hardcoded in configuration files or CI/CD pipelines, making them prime targets for attackers. NIS2 Article 21(2)(i) explicitly requires access control policies to cover all accounts with access to network and information systems, including these non-human identities.
Another significant vulnerability stems from dormant accounts. These accounts belong to individuals who no longer require access, such as former employees, contractors, or vendors, but whose credentials remain active. This is a direct violation of Article 21(2)(i), which mandates lifecycle management within access control policies. Offboarding processes often fail to revoke all associated credentials, leaving direct database access, VPN certificates, cloud IAM users, or SSH keys active across various systems. Effective access reviews, with documented and exportable histories, are crucial to address this.
Finally, many organizations fall short on implementing phishing-resistant multi-factor authentication (MFA). While Article 21(2)(j) requires MFA "where appropriate," guidance from ENISA and broader regulatory trends indicate this applies to all privileged access and remote access to critical systems. SMS-based one-time passwords (OTPs) are no longer considered sufficient for these contexts due to risks like SIM swapping, with NIST SP 800-63B classifying them as restricted authenticators. Phishing-resistant methods, such as FIDO2/WebAuthn, hardware security keys, or certificate-based authentication, are the expected standard. Exceptions for legacy systems or shared accounts are likely to draw auditor scrutiny.
A common underlying issue for these gaps is the lack of a centralized system to track credentials, enforce access policies, and automatically generate auditable evidence. Auditors require documented access control policies, technical enforcement evidence (e.g., fine-grained password policies, MFA enrollment reports), access review records, inventories of privileged accounts with ownership details, credential rotation logs for service accounts, and offboarding records with timestamps. Without a system that logs and exports this information, controls are effectively invisible to auditors.
To achieve compliance, organizations should first conduct a comprehensive inventory of all credentials, including shared accounts, service accounts, API keys, and any credentials stored outside managed systems. The next step involves deploying a centralized credential vault that supports strong encryption (e.g., AES-256), role-based access control (RBAC), and integration with existing identity management systems like Active Directory or LDAP. A self-hosted deployment can address data sovereignty concerns. Finally, organizations must enforce phishing-resistant MFA and least-privilege access principles across all relevant accounts and systems.
