Use case · NIS2 · Identity and Access Management
NIS2 and IAM: which rules apply to your organisation?
The European NIS2 Directive establishes a common cybersecurity framework, but it does not create an identical compliance journey in every country. National legislation, competent authorities, assessment frameworks and implementation timelines depend on the activities and legal situation of each entity. An organisation operating in France may therefore face a different regulatory context from one established in Belgium, even when both are part of the same international group.
Identity and access management provides a practical way to address part of these security requirements. Knowing which people and processes have access, managing authentication, governing entitlements, limiting privileges and retaining evidence of control operations can help organisations reduce risk. The appropriate implementation depends on the applicable legal framework and the existing information systems.
Choose the regulatory context you want to explore. If your organisation operates across several countries, select the Multinational journey.
France: prepare ReCyF IAM controls
- Status
- National transposition in progress
- Framework
- ANSSI — Référentiel Cyber France
In France, national transposition of NIS2 is not yet complete as of 19 October 2026. ANSSI has nevertheless published the Référentiel Cyber France (ReCyF) and practical guidance that help organisations prepare security measures. ReCyF objective 10 is particularly relevant to IAM: it addresses identification, authentication and access-rights management, with cross-cutting attention to traceability and account lifecycles.
This preparation must not be confused with a general obligation already in force under the future transposition. The legislation applicable to each organisation must be taken into account, including existing arrangements and, for certain categories of digital service providers, European Implementing Regulation 2024/2690. The operational challenge is to initiate controls justified by the risks and make their operation demonstrable.
Where should you start with identities and access?
An initial task is to make the inventory of identities and accounts reliable, identify technical-account owners and secure joiner, mover and leaver events. Control over authentication mechanisms and privileged access must be coordinated with entitlement governance and logging arrangements. Finally, the controls performed must leave usable records, from access-review decisions to the effective revocation of rights.
Belgium: implement demonstrable IAM controls
- Status
- National law in force since 18 October 2024
- Frameworks and authority
- CCB · CyberFundamentals (CyFun) · ISO/IEC 27001
In Belgium, the law transposing NIS2 is already in force. Organisations within its scope must implement cybersecurity risk-management measures and comply with the obligations applicable to their situation. The Centre for Cybersecurity Belgium (CCB) oversees, in particular, assessment routes for essential entities, which may be based on CyberFundamentals, ISO/IEC 27001 or a direct inspection. The choice of route and control requirements must be assessed against the classification of the entity and the applicable framework.
The deadline of 18 April 2026 has now passed. The deadline of 18 April 2027 is another important milestone for certain essential entities, depending on their assessment route. Within the IAM scope, organisations must be able to demonstrate that they know their identities and accounts, govern rights and privileges, control authentication and retain usable evidence. Implementing these controls contributes to risk management without, on its own, constituting NIS2 certification.
Where should you start with identities and access?
The first step is to connect identities to the accounts and entitlements actually present in systems. Organisations can then examine MFA coverage, privileged access, revocation processes, resource owners and the traceability of decisions. Evidence must be organised to support the selected assessment, taking into account the entity’s responsibilities and the CCB’s expectations.
Multinational: a shared IAM foundation, obligations to be determined locally
- Status
- Analysis by entity, activity and jurisdiction
- Framework
- NIS2 Directive · National transpositions · Article 26
For an international group, the difficulty is not simply understanding NIS2 requirements, but determining which entities are concerned, on what grounds and under the jurisdiction of which authorities. Article 26 of the Directive establishes territorial rules and exceptions for certain activities, particularly digital activities. Knowing the country of the registered office is therefore not sufficient to determine all of a group’s obligations.
Shared IAM governance can nevertheless provide an operational response across several jurisdictions. It harmonises identity sources, account lifecycles, entitlement models, authentication policies, privilege control and evidence production. This sharing must preserve the specific responsibilities of the entities concerned, the requirements of competent authorities and any specific local regulatory provisions.
Where should you start at group level?
A group can begin by mapping its entities and populations, identifying identity sources and local responsibilities, and then defining the IAM controls that can be shared. Entitlement rules, revocation processes and traceability can be industrialised within a common foundation, while evidence and specific requirements are adapted to the applicable jurisdictions. This approach avoids multiplying architectures without assuming that a single arrangement is legally sufficient everywhere.
What IAM helps you control within an NIS2 programme
Identity and access security represents only part of NIS2 requirements. It nevertheless plays a role at several essential stages of risk management: identifying people and systems, applying access decisions, limiting privileges and retaining evidence. These mechanisms must work together and be supported by known responsibilities.
Identify people, accounts and processes
An organisation must be able to connect the accounts present in its applications and infrastructure to the identities or processes that use them. This requires reliable reference sources, a usable inventory and identified owners, including for service accounts and other non-human identities.
Govern rights over time
Entitlements must follow business needs, from granting through to removal. Joiner, mover and leaver events, access requests, approvals and recertifications help organise this lifecycle, provided decisions are based on understandable rules and clearly designated owners.
Control authentication and privileges
Authentication, particularly multi-factor authentication where justified by the risks, helps secure access journeys. Privilege management must also control sensitive actions, administration accounts and the secrets used, without systematically equating a PAM policy with simply installing a bastion host.
Produce evidence of control
A control is only genuinely usable over time if its operation can be verified. Revocation histories, access-review decisions, authentication policies, sensitive-operation logs and account owners help document operational control in line with the requirements that actually apply.
These controls are an IAM contribution to risk management. They replace neither the full set of cybersecurity measures required by NIS2 nor the regulatory procedures specific to each country.
Reference legislation and frameworks
European legislation establishes the general NIS2 framework, while national transpositions and publications by competent authorities help explain the obligations applicable in each country. The information above reflects the situation verified as of 19 October 2026 and must be reviewed when new legislation or timetables are published.
Have you already identified an IAM workstream?
If your obligations and security priorities are already defined, the next step is to turn control objectives into processes that can actually be operated. Ariovis supports the scoping of identities and access, entitlement governance, the security of authentication and privileges, and then the integration and operation of the selected capabilities. The initial discussion identifies the scope, responsibilities and next useful action without presupposing a technology choice.