Passwork tames NIS2 chaos

Article by Nacata Security, 22/09/2026

Does your organization know exactly who is accessing which credential right now?

The NIS2 directive turns that gap into personal liability for your executives.

From 2026, EU authorities will review your NIS2 documentation, and Article 20 allows personal sanctions against senior management for violations.

34% of European organizations report a severe shortage of identity management talent, according to ENISA 2025 — precisely when they need it most.

The clock is ticking and shared credentials are the hole.

Article 21 of NIS2 requires access control, MFA, and credential hygiene. The challenge isn’t writing those policies — it’s proving they are enforced. Database passwords, API keys, and service accounts don’t go through corporate SSO and fall outside the audit trail. When an auditor asks who accessed production in the last ninety days, most organizations improvise through logs and emails.

Without a record, there is no possible defense against the fine.

Article 34 sets penalties of up to ten million euros or 2% of global turnover for essential entities, and up to seven million or 1.4% for important entities. The ECSO NIS2 Transposition Tracker confirms that authorities require documented evidence, not just written policies. Organizations managing credentials with spreadsheets have nothing to show.

A credential manager closes that gap before the auditor arrives.

Tools like Passwork log every action on every credential: who accessed it, when, from which IP, and what changed. Those logs are exportable and linked to the corporate directory. When someone leaves the organization, revoking their access in Active Directory automatically revokes access to the vault as well, with a timestamp record included.

NIS2 compliance without evidence is worthless.

Organizations that treat NIS2 as paperwork invest more time and get less in return. Those that bring real order to their credential management come out with a lighter helpdesk burden, a smaller attack surface, and evidence ready for the auditor.

The real gap is where SSO doesn’t reach.

SSO covers individual logins, but not passwords for staging environments, API keys, or legacy accounts. Those credentials circulate through internal messages or browsers without leaving a trace. NIS2 requires exactly that trace. Without a vault with role-based access control and an audit log, those credentials represent both the biggest compliance gap and the greatest operational risk at the same time.

AD/LDAP integration can be completed in under an hour.

The base installation and connection to the corporate directory are completed in under an hour. User provisioning becomes automatic: team members inherit vault access through their AD group upon joining; when they leave, access is revoked in the same action with an automatic timestamp record.

AES-256 encryption with zero-knowledge architecture satisfies Article 21.

Article 21(2)(h) requires encryption in transit and at rest. A self-hosted deployment with zero-knowledge architecture ensures that credentials never leave your infrastructure, with no dependency on cloud providers outside European jurisdiction, also addressing Article 32 of the GDPR.

Native MFA without third-party integrations.

Article 21(2)(j) requires MFA or continuous authentication wherever technically feasible. Native support for TOTP, biometrics, passkeys, and security keys such as YubiKey covers that mandate without adding additional silos. If you already have SSO with SAML, MFA is inherited from the existing identity provider with no extra configuration.

The 2026 deadline won’t wait.

National authorities are already reviewing documentation. Every week without credential traceability is a week of real exposure — both to security risk and regulatory sanction.

Could you demonstrate today who accessed your critical credentials last month?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime