NIS2 Compliance: 7 low-cost steps to protect credentials

NIS2: 7 low-cost measures to protect credentials

Credentials were compromised in 28% of the attacks analyzed in the Verizon 2026 Data Breach Investigations Report, making their management a critical point for NIS2 compliance. The European directive requires risk management measures proportional to the specific risks of each organization, as established by Article 21. In a context of limited budgets, protecting credentials offers a concrete starting point, without the need for new infrastructures.

Quick Answer

The scope of NIS2 and the importance of credentials

NIS2 applies to medium and large entities in 18 critical sectors identified by the European Commission. The directive requires five specific measures related to credential security: basic cyber hygiene, access policies, human resource security, asset management, and procedures for verifying the effectiveness of controls.

Why credentials are a critical point

Compromised credentials represent a significant risk for organizations. According to Verizon's analysis, over a quarter of attacks involved stolen or compromised credentials. This makes credential management a priority area for NIS2 compliance, especially in a context of limited budgets.

The importance of visibility and control

Visibility and control of credentials are essential for NIS2 compliance. An up-to-date inventory, a designated owner, and a regular review cycle are fundamental steps to effectively manage credentials. This approach allows identifying and revoking dormant accesses, reducing the risk of compromise.

The need for concrete evidence

Organizations must be able to demonstrate the effectiveness of the implemented controls. This means maintaining detailed records of reviews, exceptions, and corrective actions. Building this trail of evidence as controls are implemented keeps the work proportional to the size of the team.

The use of MFA and advanced access controls

Article 21(2)(j) of NIS2 mentions multi-factor authentication (MFA) as a measure to be applied "where appropriate." This leaves organizations the flexibility to implement MFA based on the specific level of risk. Externally exposed applications, remote accesses, and privileged administration are the first candidates for MFA.

The remedy gap between controls

Verizon's analysis reveals that only half of third-party MFA exposures are resolved within a month, while weak password configurations and permission configuration issues take nearly eight months to be resolved. This remedy gap underscores the importance of implementing a range of controls, not just MFA.

7 low-cost steps to protect credentials

Here is a list of seven priority controls for credential security, ordered by effort and cost:

• Inventory of privileged and shared credentials: Identify and document all privileged and shared credentials.
• Review of dormant accounts: Disable inactive accounts to reduce the risk of compromise.
• Implementation of MFA: Apply multi-factor authentication to high-risk accesses.
• Management of shared credentials: Assign clear owners and revoke accesses when necessary.
• Role-based access: Implement role-based permissions to limit access to sensitive data.
• Training on credential security: Educate employees on best practices for credential management.
• Protection of service credentials: Manage and protect credentials used by applications and automations.

Management of shared credentials

Shared credentials represent a governance problem before a technical one. A password shared in a chat or spreadsheet has no clear owner, cannot be selectively revoked, and has no usage log. This makes it critical to assign clear owners and revoke accesses when necessary.

Protection of service credentials

Service credentials, used by applications and automations, are often not adequately managed. Isolating these credentials in a dedicated vault, assigning a clear owner, and rotating them regularly closes these security gaps.

How Passwork supports NIS2 compliance

Passwork offers solutions for credential management that support NIS2 compliance. The platform allows maintaining an up-to-date inventory of credentials, implementing MFA, managing shared credentials, and protecting service credentials. Passwork is available in two plans: Standard at 3 € per user per month and Advanced at 4.5 € per user per month, with custom pricing options for large deployments.