Compliance and sectors
NIS2 and access management: what the Dutch Cyber Security Act asks
The Dutch Cyber Security Act, the Dutch implementation of NIS2, asks you to limit access to what the job needs, revoke accounts on time and trace every change. KoppelHet covers that part with Joinly, which automates the access lifecycle from the HR system in Microsoft Entra ID and Active Directory and logs every change.
What it is
The NIS2 duty of care has ten areas of measures. Several concern access management: access security policy, strong authentication, least privilege and lifecycle management, logging, and supply chain security.
In practice an auditor asks four questions. Why does this person have access? Were leavers and externals closed off on time? Where is it recorded when someone gained or lost access? Does actual access match intended access?
Even organisations outside the law can get access management requirements through their customers. That is the supply chain obligation.
How Joinly handles it
- Roles, manual and conditional on department, job and location from HR: access based on policy.
- Conditional roles are recalculated on every HR change: least privilege that keeps up.
- Offboarding workflows and an end date on temporary access: timely revocation.
- Externals and guest accounts in the same lifecycle, with a mandatory end date.
- Access review with corrections per identity or in bulk: periodic checks.
- Immutable audit log on every change, with actor, source and old and new value.
- Emergency block during an incident: disable the account, revoke sessions, reset MFA.
What KoppelHet does
Joinly covers access management, not the whole duty of care. It is not a SIEM or a PAM tool, and it does not replace a risk assessment, pentest or incident response plan. What KoppelHet adds is the HR side: without reliable termination dates and jobs in HR, no IAM system can prove that access is right.
Joinly
Continue at Joinly
Joinly is KoppelHet's IAM software. joinly.app shows how the product handles this, with screens, pricing and a demo.
Common integrations
Frequently asked questions
Does Joinly make an organisation NIS2-compliant?
No, no product does. Joinly covers access management and evidence. The other measures remain your own responsibility.
Is my organisation covered by the Cyber Security Act?
The law applies to essential and important entities in designated sectors, usually from 50 employees or 10 million euros turnover. All municipalities, provinces and water boards are covered. The NIS2 check on joinly.app gives a first answer in eight questions.
Is MFA mandatory under NIS2?
Strong authentication is an explicitly named area. The MFA policy itself lives in Entra ID. Joinly handles MFA resets and the Temporary Access Pass and logs who performed them.
More on Identity and access management
Identity and access management: the overview
Lifecycle
Roles and governance
Integrations
- HR as the sourceThe HR system decides who gets an account, with which data.
- Microsoft Entra IDAccounts, groups and licences in Entra ID from HR.
- Active DirectoryOn-premises AD and hybrid Exchange through an agent without an open port.
- Application provisioningAccounts and roles in your business applications, from HR.
- SCIM and SCIM GatewayThe provisioning standard, also for applications without SCIM.
Compliance and sectors
- NIS2 and the Dutch Cyber Security ActWhat the duty of care asks of access management, and what it does not.
- IAM in educationSchool board staff, ready for the IBP standards framework.
- IAM in governmentMunicipalities, provinces and water boards, with BIO and ENSIA.
- IAM in healthcareFlexible staff, multiple contracts and NEN 7510.