NIS2 puts boards on the hook for access control and asks for proof it works
- Severity
- Medium
- Sources
- 1
What happened
NIS2 Article 20 requires management bodies to approve and oversee Article 21 measures, including access control policies, asset management and MFA or continuous authentication where appropriate, and makes them liable for infringements subject to national law. Maximum fines are at least EUR 10m or 2% of global turnover for essential entities and at least EUR 7m or 1.4% for important entities, and Article 32 allows temporary bans on managerial functions in limited cases. Defenders should give boards evidence of who holds access to critical systems, why, who approved it, expiry and revocation records, and the status of exceptions. The article notes the Court of Justice of the European Union has been asked to impose financial sanctions on four member states.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Ask for evidence of how access controls work in practice, not only what the policy requires.
- Review exceptions such as old active accounts, excessive privileges, unreviewed MFA exemptions and supplier access beyond contract end dates.
- Confirm who owns access-control risk and whether that owner has the authority and budget to fix problems.
- Make sure board members receive cybersecurity training, as Article 20 requires.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Government agencies