NIS 2 access control under Article 21(2)(i)+(j)
Article 21(2)(i) names access control policies. Article 21(2)(j) names multi-factor authentication. CIR §11 covers them together in seven sub-sections. This page walks the broader policy, privileged-account and identity duties. The dedicated MFA page covers §11.7.
The short version
Access control sits at points (i) and (j) of Article 21(2). Point (i) names 'human resources security, access control policies and asset management'. Point (j) names 'the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications'. Both apply to every essential and important entity across the EU.
CIR (EU) 2024/2690 §11 covers both letters together, under the heading 'Access control (Article 21(2) points (i) and (j) of Directive (EU) 2022/2555)'. It splits the duty into seven sub-sections: the policy itself, rights management, privileged accounts, system-administration systems, identification, authentication, and multi-factor authentication. This page walks §11.1 through §11.6. For §11.7 specifically, see the dedicated MFA page.
Germany puts the policy duty into §30(2)(9) BSIG and the MFA duty into §30(2)(10) BSIG. The BSI's IT-Grundschutz module ORP.4 'Identitäts- und Berechtigungsmanagement' is a recommended way to implement it, not a legal baseline.
Article 21(2)(i) + (j) NIS 2 Directive (2022/2555)
(i) Human resources security, access control policies and asset management. (j) The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.
Points (i) and (j) are two of the ten Article 21(2) measures. (i) bundles three things, of which access control is the middle item. (j) sits next to it on the list. CIR point 11 covers both together.
CIR (EU) 2024/2690, Annex §11
Access control (Article 21(2), points (i) and (j) of Directive (EU) 2022/2555).
CIR §11 has seven sub-sections: §11.1 access control policy, §11.2 management of access rights, §11.3 privileged accounts and system-administration accounts, §11.4 system-administration systems, §11.5 identification, §11.6 authentication, §11.7 multi-factor authentication. This regulation binds only the entity types listed in its Art. 1 (DNS, TLD, cloud, data centres, CDNs, MSPs, MSSPs, online marketplaces, search engines, social networks, trust services).
§30(2)(9) and (10) BSIG (Germany)
9. Erstellung von Konzepten für die Sicherheit des Personals, die Zugriffskontrolle und für die Verwaltung von IKT-Systemen, -Produkten und -Prozessen, [...] 10. Verwendung von Lösungen zur Multi-Faktor-Authentifizierung oder kontinuierlichen Authentifizierung, gesicherte Sprach-, Video- und Textkommunikation sowie gegebenenfalls gesicherte Notfallkommunikationssysteme innerhalb der Einrichtung.
Germany splits the EU's point (i)+(j) into two BSIG numbers. §30(2)(9) carries access control and asset management. §30(2)(10) carries MFA and secure communications. The substance is the same EU rule.
Policy and rights management
Write down how access works (logical and physical) for staff, visitors, providers and service providers. Grant, modify and revoke rights based on business need: need-to-know, least privilege, separation of duties. Every right is assigned to a named person. Revocation runs on employment change, not on a weekly cycle. Third-party access (visitors, providers) is tracked.
Privileged and admin accounts
Admin accounts get strong identification, authentication and authorisation. Dedicated administration accounts only, used solely for installation, configuration, management and maintenance. Admin rights are tailored individually and restricted. System-administration systems are used only for administration, logically separated from application software not used for administration, and protected by authentication and encryption.
Identity and authentication
Identity lifecycle: unique IDs, each ID linked to one person, monitoring and logging across the lifecycle. Authentication procedures match the access control policy: authentication strength scaled to the asset's classification, change procedures, lockout on failed attempts, session timeouts, separate credentials for privileged accounts.
Need-to-know, least privilege, separation of duties
Point 11.2.2(a) CIR names all three (the German version says need-to-use where the English says least privilege). Need-to-know: only people who need the data get the data. Least privilege: rights match the task, not the title. Separation of duties: no single person should be able to grant, use and audit the same right. If your AD groups are 'IT' and 'everyone else', you have not implemented any of the three.
Privileged is not just regular with more rights
For the digital providers the CIR covers, points 11.3 and 11.4 raise the bar specifically for admin accounts. Strong identification. MFA named in §11.3 itself, not just §11.7. Dedicated accounts used only for admin work. System-administration systems logically separated from application software. The point: a compromised admin account compromises everything, so admin accounts get their own regime.
BSI / IT-Grundschutz ORP.4
The BSI's IT-Grundschutz module ORP.4 'Identitäts- und Berechtigungsmanagement' covers identity lifecycle, role-based rights, separation of privileged accounts, password rules and reviews. For companies it is a recommendation. Only for federal administration bodies does § 44(2) BSIG say that meeting the Grundschutz minimum requirements fulfils § 30.
ENISA Technical Implementation Guidance
ENISA's Technical Implementation Guidance for CIR (EU) 2024/2690 walks each §11 sub-section in operational language and maps it onto ISO/IEC 27001:2022 (among others A.5.15 to A.5.18, A.8.2, A.8.3 and A.8.5) and NIST CSF 2.0 (PR.AA). ENISA states the mapping is not a measure of equivalence, so check an existing ISO 27001 setup against each point.
National transposition laws
Every member state transposes Article 21(2)(i) and (j) into its own law (Netherlands: Cyberbeveiligingswet; Austria: NISG 2026; Belgium: its NIS2 law). The directive sets a minimum and member states may go further (Art. 5 NIS 2), so the national text decides. What also differs: which baseline standard the national regulator points at.
We have AD groups, so we have access control.
A start, not the finish. For the digital providers the CIR covers, points 11.1 and 11.2 ask for a documented access-rights policy, rights assigned to named persons, a revocation procedure tied to employment change, and an audit log of grants and revocations. AD groups give you the mechanism. They do not give you the policy, the named-person register, or the joiners-movers-leavers procedure.
Our admins use their normal account for admin work, with sudo or 'run as administrator'.
For the digital providers the CIR covers, point 11.3.2(b) requires specific accounts used exclusively for system administration, such as installation, configuration, management or maintenance. For everyone else it is sound practice, not a legal duty. An admin's regular account is for email, calendar and Excel; a separate admin account, with its own second factor, is for privileged work. Mixing the two means a phishing email can reach the admin role.
We sync access rights every Monday morning.
Close, but not what point 11.2.2(b) CIR asks for: rights change upon termination or change of employment, not on a calendar cycle. For the review of rights, point 11.2.3 says 'at planned intervals', and no text sets the interval. (Both bind the digital providers the CIR covers.)
A typical setup: Active Directory or Entra ID for identities, AD groups for application access, an HR system that issues onboarding tickets to IT. That gives you the mechanism. The policy work sits in three places.
Three places to check first: a written access control policy that is current and approved, dedicated administration accounts, and a joiners-movers-leavers procedure driven by HR rather than by IT alone (otherwise a contractor's account lingers because HR never told IT they left).
- Directive (EU) 2022/2555 (NIS 2), Article 21(2)(i) and (j): eur-lex.europa.eu/eli/dir/2022/2555/oj
- Commission Implementing Regulation (EU) 2024/2690 (CIR), Annex §11: eur-lex.europa.eu/eli/reg_impl/2024/2690/oj
- BSI Act (BSIG), §30(2)(9) and §30(2)(10) as amended by the NIS2 Implementation and Cybersecurity Strengthening Act
- IT-Grundschutz Compendium, module ORP.4 'Identitäts- und Berechtigungsmanagement': bsi.bund.de/grundschutz
- ENISA Technical Implementation Guidance for CIR (EU) 2024/2690 (version 1.0, June 2025)
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Access Control & HR Security
Write the staff, access and asset policy
Who gets into what, and what happens when someone leaves.
Authentication & Communications
Record where a second factor protects
For each program on your list: password alone, or with a second factor.
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
