Most Access Breaches aren't the result of malicious hacks, rather of negligence

The first NIS2 compliance audits were targeted for June 30, 2026. That date has passed. For Information Security Managers at organisations in scope (energy, banking, insurance, government, infrastructure, and roughly a dozen other sectors) the directive is no longer a future obligation. It is an active audit reality, and 160,000-plus entities across the EU now fall under it.

Article 21 sets out ten mandatory risk-management measures. Access control sits among the most auditable and breach-critical of them, alongside multi-factor authentication and audit logging. Unlike a policy document, access control produces evidence a regulator can actually verify: permission matrices, MFA enforcement reports, logs showing who accessed what and when. A policy sitting in a shared folder is not a control. A control is an enforced technical measure with an audit trail showing it applies consistently across every account, system, and user type.

And the audits are finding gaps in predictable places. The most common pre-audit failures reported so far: missing MFA on internal systems, over-privileged accounts, and dormant identities that were never disabled after someone left the organisation. None of that requires a sophisticated attacker to exploit. It just requires someone to still have access they shouldn't.

That matters because the penalty structure is no longer abstract. Essential entities face fines of up to €10 million or 2% of global turnover. Important entities face up to €7 million or 1.4%. And NIS2 introduces something GDPR enforcement has made organisations less complacent about but boards still underestimate: personal liability for senior management. In cases of negligence or repeated non-compliance, national authorities can hold directors personally accountable. Access management has moved from an IT ticket queue to a board-level governance question.

The technical shift underlying all of this is the move toward zero-trust thinking:  access is continuously validated, not assumed after someone logs in once. In practice, that means role-based access control that enforces least privilege at scale, access reviews that happen on a schedule rather than when someone remembers, and offboarding that actually revokes access the day someone leaves, not the week after.

The organisations struggling most with this aren't the ones without a policy. They're the ones where the policy exists on paper but was never translated into an enforced, auditable system. Multiple roles typically need to align for this to work: Information Security, Data Governance, IAM, DPO, and IT Systems Administration all touch access decisions, often without a single shared view of who has access to what and why.

The fix is not glamorous. It's a structured access review, a documented RBAC model mapped to actual job functions, and a process for keeping both current as the organisation changes; because access management done once is access management that decays within a quarter.

So the question for your next internal audit: if a regulator asked for a list of every account with access to your most sensitive systems, right now, could you produce one you'd actually trust?