NIS2 does not contain a line that says "revoke access within X hours of termination." Instead, it requires organizations to implement access control policies and be able to demonstrate them, which means orphaned access is exactly the kind of gap an auditor or incident investigator will find.
Where access control shows up in NIS2
Article 21 of the NIS2 directive requires "essential and important entities" to implement risk management measures including access control policies, asset management, and incident handling. It does not prescribe specific tooling, which means the burden of proof falls on you to show your access control process actually works, not just that a policy document exists.
Why offboarding is the weak point
Onboarding tends to get scrutiny because it is visible: new hires complain loudly if they can't log in. Offboarding is quiet. Nobody notices an ex-employee still has Slack access until it becomes an incident, and by then it is a finding in a post-mortem instead of a line in a policy review.
What auditors and incident responders actually ask for
- Evidence of when access was granted and revoked, with timestamps and actor attribution
- A documented process for joiners, movers and leavers (JML), not just onboarding
- Proof that access reviews happen on a defined cadence, not ad hoc
- A way to show which systems were in scope for a given identity at a given time
The gap between "we have a policy" and "we can prove it"
Most companies preparing for NIS2 already have an offboarding policy document. The gap is almost never the policy: it is proving the policy was actually followed, every time, across every tool, with a timestamped record. That is an operational and tooling problem, not a paperwork problem.
AccessRevoke generates exactly that evidence trail automatically: every revoke, grant, and failed action is logged with a timestamp and actor, self-hosted inside your own infrastructure so the audit trail never leaves your perimeter. If NIS2 readiness is on your roadmap, closing the offboarding gap is one of the highest-leverage places to start.