NIS2 does not ask for an identity platform. It asks for measures that are actually in force, an executive who can vouch for them, and a coherent account of an incident inside deadlines that start counting before anyone understands what happened.
The first NIS Directive asked a few operators of critical infrastructure to take cybersecurity seriously. NIS2 asks eighteen sectors, names the people responsible, and attaches a clock to the reporting.
Energy, transport, banking, health, water, digital infrastructure and public administration as essential entities; manufacturing, food, chemicals, postal services, waste and digital providers as important ones. Everyone else meets it through a customer's third-party questionnaire.
Management bodies approve the measures and oversee them, and in essential entities inadequate governance can mean temporary suspension from managerial duties. That single provision is why NIS2 conversations happen at board level and not in a security backlog.
Each member state transposes it under its own name, with its own authority and its own portal — and some extended the scope. A group operating in six countries is complying six times, which is exactly where centralised controls start paying for themselves.
Three notifications, three deadlines, one story that has to stay consistent across all of them. Under each stage is the question the identity layer is expected to answer — and it is the same question three times, at increasing precision.
A first notification to the national authority: something significant is happening, whether it looks malicious, and whether it may have cross-border effects. At this point nobody knows the full story yet, and the deadline does not care.
Which identities and accounts are involved, and what do they have access to right now?
An initial assessment: severity, impact, indicators of compromise. The gap between the first and second deadline is where an organisation either has its own account of events or starts reconstructing one from screenshots.
Was that access legitimate, when was it granted, and by whom — and what has been cut since?
The full description: root cause, mitigations applied, cross-border impact. This is the document that gets read again if the authority comes back, and the one that has to agree with the two notifications sent before it.
Can the same history be produced twice, months apart, and match?
Nothing here is answerable by an authentication log alone. The 72-hour assessment needs entitlements and approvals as well as sessions — what the access allowed, not only that it happened.
NIS2 organises itself around four areas. Identity contributes to all four and is sufficient for none of them, which is worth saying before a project is scoped as if it were.
During an incident the useful action is narrowing or ending access while the investigation is still running. Sessions carry a lifetime, a scope and conditions, and can be shortened, elevated or terminated from outside the application.
Entitlements, approvals, grants and removals with their history intact — including for identities that are no longer active. It is the same artefact an auditor asks for and an authority expects in the final report.
Supply chain security is explicit in the directive, and most of it arrives as people from other organisations holding access to your systems. External populations get their own domain, their own lifecycle and an expiry that is enforced.
It does not make an organisation compliant. NIS2 is a governance, risk and continuity obligation: it needs a risk register, a tested incident response process, named owners and management signoff. An identity platform supplies controls and evidence for part of it — the part that answers who could do what, and when.
This page describes how an identity layer contributes to NIS2 obligations. It is not legal advice, and it is not a certification claim: whether an entity is in scope, and what satisfies its national authority, is a question for counsel and for the authority itself.
Usually there is one: access nobody can date, an account nobody owns, a session that outlived the contract. That is where the identity part of NIS2 is decided.
Talk to an expert