NIS2 Compliance: Fixing IAM and Access Control Before the 2026 Audit

A security team that cannot produce a list of who has access to what, and prove why each person still needs it, is no longer just exposed to attackers. Under the NIS2 Directive, that same gap now exposes the organization to regulators, and it exposes the executives who run the organization to personal liability. Auditors are not arriving to grade the sophistication of a security program. They are arriving to check whether an organization can produce evidence, on demand, that access to sensitive systems and data is authorized, reviewed, and logged.

That distinction matters because it changes what “good enough” looks like. As Help Net Security reported on September 1, 2026, audits tied to national NIS2 transposition laws are turning legally binding across EU member states this October, with several countries setting hard registration and enforcement dates for the weeks ahead. Essential entities face fines up to 10 million euros or 2 percent of global annual turnover, whichever is higher. Important entities face up to 7 million euros or 1.4 percent of turnover. Management bodies, meaning boards and named executives, face personal liability that can include temporary bans from holding leadership roles if their organization cannot demonstrate reasonable governance over cybersecurity risk.

None of this hinges on whether an organization has ever been breached. It hinges on whether the organization can show its work. A dormant service account nobody has reviewed in eighteen months, a contractor who left the project but kept administrative rights, an audit log that exists but cannot be exported in a format an assessor can use, each of these is a finding waiting to happen, regardless of whether anyone has exploited them yet.

This is why identity and access management has moved from a technical hygiene item to a board-level compliance risk almost overnight. Organizations that treat NIS2 compliance as a documentation exercise, rather than an evidence-generation exercise, are the ones most likely to fail their first audit. The rest of this piece walks through what the evidence standard requires, why credential and access visibility is the fastest path to closing the gap, and how a platform built around unified audit logs and governed access changes the arithmetic before the assessor ever shows up.

Key Takeaways

1. NIS2 penalizes missing evidence, not imperfect security.

Auditors are checking whether organizations can prove access was authorized, reviewed, and logged, not whether their security program is flawless.

2. The financial and personal stakes are both severe.

Essential entities face fines up to 10 million euros or 2 percent of global turnover, important entities face up to 7 million euros or 1.4 percent, and management bodies can face personal liability including temporary executive bans.

3. Access control evidence is the fastest compliance win available.

Inventorying credentials, closing dormant accounts, and enabling exportable audit logs can move an organization toward audit readiness in weeks, while other NIS2 obligations, such as supply chain risk management, take months to operationalize.

4. The gaps regulators find most often are specific and recurring.

Dormant accounts, over-privileged roles, and credentials nobody has reviewed in 90 days or more are the evidence gaps that show up across nearly every failed access control assessment.

5. Unified audit logging and attribute-based access control close the gap directly.

Platforms that generate a single, exportable audit trail across every sensitive data channel, paired with role-based and attribute-based permissions, give compliance teams the evidence an assessor expects without a manual reconstruction project.

The Evidence Standard Behind NIS2 Enforcement

NIS2, formally Directive (EU) 2022/2555, replaced the original NIS Directive with a much broader scope and a materially stricter enforcement posture. It covers essential and important entities across energy, transport, banking, health, digital infrastructure, public administration, and a growing list of other sectors that member states have folded into their national transposition laws. Two provisions matter most for this discussion. Article 21(2)(i) requires the use of multifactor authentication, secure communications, and access control policies. Article 21(2)(d) requires supply chain security measures that extend an organization’s accountability to its vendors and service providers.

The practical difference between these two obligations is timeline. Help Net Security’s reporting notes that organizations can typically stand up documented, enforceable access control policies within two to four weeks, while supply chain risk management programs realistically take six to twelve months to mature. That asymmetry is exactly why access control has become the opening move for organizations racing toward an October compliance deadline. It is the NIS2 requirement most directly under an organization’s own control, and it is the one auditors can verify fastest, because the evidence, or the absence of it, sits in identity systems and log repositories that already exist.

What auditors are testing is whether an organization’s stated access policy matches its deployed reality. A written policy that says access is reviewed quarterly means nothing to an assessor if nobody can produce the review records. A claim that dormant accounts are disabled promptly means nothing if the identity system shows service accounts that have not authenticated in over a year and are still active. This is the evidence standard NIS2 introduces, and it is unforgiving of the gap between what a security policy document says and what the infrastructure enforces.

Penalty Tiers and Personal Liability for Management Bodies

The financial exposure under NIS2 is structured in two tiers that track the criticality of the sector involved. Essential entities, which include large organizations in energy, banking, health, and digital infrastructure, face administrative fines of up to 10 million euros or 2 percent of total worldwide annual turnover for the preceding financial year, whichever amount is higher. Important entities, a broader category covering postal services, waste management, food production, and manufacturing among others, face fines up to 7 million euros or 1.4 percent of global turnover.

What sets NIS2 apart from many prior compliance frameworks is the personal liability layer sitting on top of those corporate fines. Management bodies, the boards and senior executives accountable for cybersecurity risk management, can be held personally liable for failures to implement adequate measures. National authorities have the power to require a public statement identifying the responsible legal and natural persons, and in the most serious cases, temporarily bar named individuals from executive or management functions until remediation is complete. That is a fundamentally different kind of pressure than a compliance officer flagging a gap analysis finding to leadership. It puts the CISO, the compliance officer, and the board in the same room with the same incentive, closing the evidence gap before the assessor arrives rather than after.

This liability structure explains why NIS2 has become one of the more discussed items in board reporting cycles this year. A Kiteworks Data Security and Compliance Risk: 2026 Annual Survey Report of 459 security, compliance, and technology leaders found that European and UK organizations rank AI and data regulatory requirements as their top compliance challenge at higher rates than any other region, a pattern the report attributes directly to the concrete enforcement environment created by GDPR, the EU AI Act, and NIS2 notification timelines. Regulatory pressure of this kind does not stay confined to policy discussions for long. It shows up in board agendas, budget requests, and increasingly in personal risk conversations with general counsel.

Why Credential and Access Visibility Is the Fastest Compliance Win

Every access control failure eventually traces back to a credential, whether that credential belongs to a human employee, a contractor, a service account, or an API key nobody remembers provisioning. Verizon’s 2026 Data Breach Investigations Report found that exploitation of vulnerabilities has overtaken credential abuse as the single most common initial access vector, now accounting for 31 percent of breaches, but credential abuse has not gone away as a threat. It has simply moved deeper into the attack chain. According to Verizon’s 2026 findings as reported by Help Net Security, credentials still surface somewhere in the chain of 39 percent of breaches, functioning less as the front door and more as the tool attackers use to move laterally once they are already inside.

The cost data reinforces why this matters to a compliance program specifically, not just a security program. IBM’s Cost of a Data Breach Report 2026 puts the global average cost of a breach at 4.99 million dollars, a 12 percent increase over the prior year and a record high. Identity and access management ranked as the third-largest cost-reducing factor IBM studied, cutting the average breach cost by 225,622 dollars when properly deployed. Mismanaged secrets and keys did the opposite, adding 198,933 dollars to the average cost when they contributed to a breach. Noncompliance with applicable regulations added a further 201,112 dollars on its own. Access governance, in other words, is not a soft control that looks good on a slide. It is one of the few levers with a directly measurable effect on both breach cost and regulatory exposure.

This is also where credential visibility earns its reputation as the fastest available compliance win. Inventorying every unmanaged credential, including service accounts, API keys, and certificates, is a project most identity teams can start immediately with tools they already own. Enforcing phishing-resistant multifactor authentication on privileged and remote access accounts follows a similarly short runway. Neither requires a new procurement cycle or a multi-quarter integration effort. What they require is the discipline to finish the inventory and act on what it reveals, which is usually a larger number of forgotten accounts and orphaned permissions than most teams expect going in.

The Access Control Evidence Gaps Auditors Find Most Often

Three specific gaps show up across nearly every access control assessment that ends badly, and they are worth naming individually because each one requires a slightly different remediation approach.

Dormant accounts are the most common finding. These are user accounts, service accounts, and API credentials that remain active in a directory long after the person, project, or integration that needed them has moved on. A quarterly lifecycle review, tied to a documented process rather than an ad hoc cleanup, is what NIS2 auditors expect to see. The absence of that review is itself a finding, independent of whether any dormant account was ever misused.

Over-privileged roles are the second recurring gap. Access accumulates over time as employees change teams, take on temporary project responsibilities, or inherit permissions from a predecessor without anyone revoking the old grants. Role-based access control, paired with attribute-based access control for more granular conditions such as device posture, location, or data sensitivity, gives an organization the structural means to keep permissions aligned to current need rather than historical accumulation. NIST SP 800-63B and ENISA guidance both point to the same underlying principle, which is that access should be minimized by default and re-earned on a defined schedule, not granted once and left alone indefinitely.

Unreviewed credentials tied to unused access, meaning accounts or keys that have not authenticated in 90 days or more, round out the list. This is the gap that a NIS2 gap analysis most often surfaces first, because it is measurable directly from log data rather than requiring interviews or policy review. An organization that can query its own identity infrastructure and produce this list within minutes is in a fundamentally different audit position than one that would need weeks to reconstruct it manually.

The Kiteworks 2026 Annual Survey Report puts a number on how widespread this evidence gap is. Sixty three percent of surveyed organizations experienced at least one compliance consequence in the past 12 months, defined as an audit finding, a required remediation plan, a board escalation, a contractual penalty, or a formal regulatory investigation. Half could not produce a complete data access audit record within one business day, and only 33 percent had tamper-evident audit trails in place at all. The report’s own recommendation is direct on this point. DORA, NIS2, and EU AI Act audit obligations run on timelines that half of organizations surveyed cannot currently meet, and building that evidence capability is not something that can be done reactively once a regulator has already asked.

Building an Audit-Ready Access Control Program

Closing these gaps is less about buying new technology and more about operationalizing controls that most organizations already own in some form. A quarterly access review cycle, documented and repeatable, is the foundation. That cycle should cover every account type, not just human employees, and should produce a record that an assessor can review without requiring a live walkthrough from the security team.

Access controls built on zero trust architecture principles, meaning nothing is trusted by default regardless of network location, reduce the population of over-privileged accounts before they can accumulate in the first place. Multifactor authentication on privileged and remote access, phishing-resistant where possible per NIST SP 800-63B Section 5.2.10, closes one of the most common initial access vectors outright. None of these controls are exotic. What separates organizations that pass an audit cleanly from those that do not is usually whether the controls are enforced technically, logged automatically, and reviewed on a fixed schedule, rather than documented in a policy that nobody consistently follows.

Centralized, exportable audit logging ties the whole program together. An assessor does not want to hear that logs exist somewhere across a dozen different systems. They want a single, coherent record of who accessed what, when, and under what authorization, produced in a format that supports the audit rather than complicating it. This is also where third-party risk intersects with access control directly, since vendor and contractor access is exactly the category of credential most likely to go stale unnoticed once a project ends.

A CISO Dashboard that surfaces dormant accounts, stale permissions, and audit log completeness in one view gives compliance and security leaders the same picture an auditor will eventually ask for, before the audit begins rather than during it. That visibility is what turns a NIS2 assessment from a scramble into a confirmation of work already done.

How Kiteworks Maps to NIS2 Evidence Requirements

Kiteworks secure data exchange is built around the same evidence-first principle NIS2 auditors are now enforcing. The platform generates a single, unified audit trail across every channel where sensitive content moves, including email, managed file transfer, file sharing, and web forms, so compliance teams are not reconstructing access history from a dozen disconnected systems when an assessor asks for it. Role-based and attribute-based access controls enforce least-privilege permissions at the content level, which directly addresses the over-privileged role gap that NIS2 audits flag most often.

Kiteworks holds FedRAMP Moderate authorization, ISO 27001 compliance certification, and SOC 2 compliance attestation, and NIS2 sits alongside these as one of the regulatory frameworks the platform is built to support with documented, verifiable evidence rather than self-attestation alone. For organizations racing toward an October compliance deadline, that means the credential inventory, the quarterly review workflow, and the exportable audit log an assessor expects are already structural features of how the platform operates, not a project to be built from scratch under deadline pressure.

Because compliance costs rise sharply the longer an organization waits to close known evidence gaps, the fastest path to readiness is usually the one that requires the least new infrastructure. Consolidating access governance and audit logging onto a platform built for exactly this evidence standard is often less expensive, and considerably faster, than trying to stitch the same visibility together across a half dozen point tools after the fact.

To learn more about closing NIS2 access control evidence gaps before your organization’s next audit, schedule a custom demo today.

Additional Resources

• Blog Post The Tug-of-War Over Your Data: How the CLOUD and SHIELD Acts Pit Security vs. Privacy
• Blog Post Secure Sensitive Data by Mapping DSPM to Your Compliance Goals
• Brief Top 3 FERPA Violations and How to Avoid Them
• Blog Post Executive Order 14117: Protecting Americans’ Bulk Sensitive Personal Data
• Blog Post Need NIS2 Compliance? Start With ISO 27001