NIS2 Access Control & MFA: Building Identity Infrastructure for Regulated Entities

NIS2 Article 21(2)(i) and (j) mandate "human resources security, access control policies, and asset management" plus "the use of multi-factor authentication or continuous authentication solutions." MFA isn't optional under NIS2 — it's a legal requirement for essential and important entities. And access control goes far beyond assigning roles in Active Directory.

NIS2 Identity Requirements

The directive requires:

• Multi-factor authentication — For all administrative access and privileged operations
• Continuous authentication — Risk-based authentication that evaluates context (location, device, behavior)
• Access control policies — Least privilege, role-based access, regular access reviews
• Secured communications — Encrypted voice, video, and text for sensitive communications
• Emergency access procedures — Break-glass access with full audit trail

Enterprise IAM Architecture

Identity Provider (IdP)

Centralize authentication through a modern IdP: Keycloak (open source), Okta, or Azure AD. Enforce MFA on all accounts — phishing-resistant methods preferred (FIDO2/WebAuthn hardware keys, passkeys). SMS-based MFA is the minimum acceptable; TOTP is better; hardware tokens are best.

Privileged Access Management

Administrative access requires additional controls:

• Just-in-time (JIT) access — No standing privileges. Request access for specific duration and scope.
• Session recording — All privileged sessions recorded and auditable
• Approval workflows — Multi-party approval for critical system access
• Break-glass procedures — Emergency access that triggers immediate alerts and audit

Kubernetes RBAC

For platform engineering, Kubernetes RBAC is a critical control surface. Map your organizational roles to Kubernetes ClusterRoles and Roles. Use namespace isolation for multi-tenant environments. Integrate Kubernetes authentication with your IdP via OIDC. Never share kubeconfig files — issue individual credentials.

Service Identity

Non-human identities need the same rigor. Use SPIFFE/SPIRE for workload identity. Kubernetes service accounts with bound tokens. Short-lived credentials for CI/CD pipelines. No long-lived API keys or service account tokens stored in environment variables.

Access Review Automation

NIS2 requires regular assessment of access controls. Automate quarterly access reviews: export current access assignments, flag over-privileged accounts, identify dormant accounts, and generate review reports for management sign-off. Revoke access automatically when employees change roles or leave.

What Open Empower Delivers

We implement NIS2-compliant identity infrastructure: centralized IAM with MFA, privileged access management, Kubernetes RBAC, workload identity, and automated access reviews. Identity is the new perimeter — we build it right.