NIS2 Spotlight: Executive MFA Exemptions Undermine Governance and Create Compliance Risk
This is an opinion/advisory piece discussing how MFA rollouts frequently break down when senior executives request exemptions, creating governance and compliance gaps under the EU NIS2 Directive. The article argues that Article 21 effectively mandates MFA while Article 20 places accountability for risk-management oversight on management bodies, yet CISOs often lack authority to enforce policy against senior leadership. It cites commentary from Jane Frankland MBE (KnewStart) and Dr Yiannis Pavlosoglou (Greek National Cybersecurity Authority) drawn from a 2026 Passwork NIS2 access management report, alongside statistics from Verizon's 2026 DBIR (credential abuse in 39% of breaches) and IBM's 2026 Cost of a Data Breach report ($4.99 million average breach cost). There is no specific incident, vulnerability, or active exploitation described; this is governance and policy guidance.
Remediação
The article recommends documenting every MFA exemption with a named risk owner, a specific reason tied to genuine operational constraints (not job title), and a mandatory review date. It advises boards to approve exemption policies, use phishing-resistant authentication where risk warrants, and avoid informal or undocumented exceptions that could constitute NIS2 Article 21 infringements, which can carry fines of up to €10 million or 2% of global turnover.
Linha do tempo
-
NIS2 Spotlight: Executive MFA Exemptions Undermine Governance and Create Compliance Risk
ler a análise desta fonte ocultar
This is an opinion/advisory piece discussing how MFA rollouts frequently break down when senior executives request exemptions, creating governance and compliance gaps under the EU NIS2 Directive. The article argues that Article 21 effectively mandates MFA while Article 20 places accountability for risk-management oversight on management bodies, yet CISOs often lack authority to enforce policy against senior leadership. It cites commentary from Jane Frankland MBE (KnewStart) and Dr Yiannis Pavlosoglou (Greek National Cybersecurity Authority) drawn from a 2026 Passwork NIS2 access management report, alongside statistics from Verizon's 2026 DBIR (credential abuse in 39% of breaches) and IBM's 2026 Cost of a Data Breach report ($4.99 million average breach cost). There is no specific incident, vulnerability, or active exploitation described; this is governance and policy guidance.
Remediation
The article recommends documenting every MFA exemption with a named risk owner, a specific reason tied to genuine operational constraints (not job title), and a mandatory review date. It advises boards to approve exemption policies, use phishing-resistant authentication where risk warrants, and avoid informal or undocumented exceptions that could constitute NIS2 Article 21 infringements, which can carry fines of up to €10 million or 2% of global turnover.