NIS2 puts boards on the hook for access control and asks for proof it works
POLICYEuropean Commissionredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
Under NIS2 Article 20, management bodies of essential and important entities must approve cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements under national law. Boards are asking for evidence of access controls, including exceptions such as stale accounts, excessive privileges, unreviewed MFA exemptions and supplier access that outlasts contracts. The European Commission has referred Ireland, Spain, France and the Netherlands to the Court for failing to fully transpose NIS2.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Ask for evidence of how access controls work in practice, not only what the policy requires.
- Review exceptions such as old active accounts, excessive privileges, unreviewed MFA exemptions and supplier access beyond contract end dates.
- Confirm who owns access-control risk and whether that owner has the authority and budget to fix problems.
- Make sure board members receive cybersecurity training, as Article 20 requires.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Security Affairs
Who and what is in it
Government agencies