NIS2 and DORA set outcomes, not tools. For identities, that means knowing who has access to what, detecting misuse quickly and being able to prove it.
Key takeaways
Access control is explicit. NIS2 names access control and multi-factor authentication among its baseline measures, and DORA expects access controls inside the ICT risk management framework.
Reporting is fast. NIS2 sets a 24-hour early warning for significant incidents, so you need to know quickly which identities were involved.
Evidence matters as much as controls. Regulators look for proof that controls work, not only for policies.
Identity security supports alignment. It gives continuous visibility and monitoring, but no tool alone makes an organisation complian
What is NIS2?
NIS2 is the EU Directive (2022/2555) on a high common level of cybersecurity across the Union. It requires essential and important entities in critical sectors to apply baseline security measures and to report significant incidents.
Because it is a directive, each Member State transposes it into national law. Check the rules that apply in your country.
What is DORA?
DORA is the EU Digital Operational Resilience Act, Regulation (EU) 2022/2554. It has applied directly since 17 January 2025 and covers the financial sector.
It is built around ICT risk management, incident reporting, resilience testing and the management of third-party ICT risk. The management body holds ultimate responsibility for the framework.
NIS2 vs DORA at a glance
Why identity attacks favour autonomy
NIS2 Article 21 lists access control policies and asset management among its minimum measures, along with multi-factor authentication or continuous authentication where appropriate.
DORA expects information security policies, procedures and access controls as part of ICT risk management.
Neither text names identity security products. They ask for outcomes, and identity is where most of those outcomes are won or lost, because attackers increasingly log in rather than break in.
What regulators will want to see
Why the reporting clock puts identity first
NIS2 gives you 24 hours to send an early warning on a significant incident. If you cannot tell which account did what, you cannot scope the incident, and the clock keeps running.
Identity activity is often the first trail to follow. Knowing which accounts were used, what they touched and whether their behaviour was normal turns a vague alert into a reportable fact.
Common challenges
Best practices
Map identities to requirements so each control has a clear owner and evidence source.
Cover privileged and non-human identities first. One compromise there does the most damage.
Monitor beyond login, down to what identities do in critical applications.
Prepare for the reporting clock with investigation steps that work in hours, not days.
Keep evidence continuous, so audits draw on what already runs.
