Most NIS2 obligations can be addressed in isolation. Remote access is the exception. Every time a contractor, vendor, or internal technician connects to a system remotely, five distinct NIS2 articles apply simultaneously: supply chain security (Art. 21 §2.d), network security (Art. 21 §2.e), encryption (Art. 21 §2.h), access control (Art. 21 §2.i), and incident reporting (Art. 23). An organisation can address every other NIS2 requirement and remain dangerously exposed if remote access is not governed correctly.

NIS2’s transposition deadline passed on October 17, 2024. Transposition is now accelerating across EU member states, and enforcement activity is expected to increase materially through 2026 and into 2027. Organizations that have not yet addressed their remote access posture are operating with active compliance risk.

Direct answer: NIS2 requires organizations to enforce MFA, least-privilege access, tamper-proof session recording, encrypted connections, and supply chain access governance for all remote access to in-scope systems. VPN-based access is structurally incompatible with these requirements.

Who Is in Scope

NIS2 classifies approximately 160,000 entities across the EU into two tiers:

• Essential entities: energy, transport, banking, healthcare, digital infrastructure, ICT service management (B2B), public administration, and space
• Important entities: manufacturing, postal and courier services, waste management, chemicals, food production, digital providers, and research organizations.

The directive also carries extraterritorial reach. Non-EU organizations providing services to EU-based entities, or operating within the EU market, must comply. For global organizations in defense, financial services, and industrial manufacturing, NIS2 is not a regional compliance exercise — it is a baseline security standard.

Under Article 20, senior management is personally liable for cybersecurity risk management. Non-compliance can result in fines, executive suspension, and, in serious cases, prosecution. Fines reach up to €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% for important entities, whichever is higher.

Why Remote Access Is NIS2’s Highest-Stakes Requirement

Remote access is the single domain where the highest concentration of NIS2 obligations converges. An organization that governs its own network correctly but fails to govern the remote access of its suppliers and contractors has a structural compliance gap — across multiple articles simultaneously.

VPN-Based Access Is Not NIS2-Compatible

A VPN grants access to a network segment, not a specific device or application. This architectural limitation makes VPN-based remote access structurally incompatible with NIS2’s supply chain security requirements.

A VPN cannot enforce need-to-know or need-to-perform access at the granularity NIS2 demands. It cannot restrict access by time window, certify individual authorization for a specific task, or generate tamper-proof session evidence for Article 23 reporting. VPNs combined with RDP remain one of the primary attack vectors against NIS2-essential organizations.

NIS2-compliant remote access requires point-to-point architecture: a controlled, authenticated, supervised, and fully logged connection between an authorized individual and a specific device, with no lateral movement capability and no persistent network foothold.

What NIS2 Requires — Article by Article

Article 21 §2.d — Supply Chain Security

Access permissions must be defined by criticality level, geography, certification status, and operational need. Contractors must be authorized for a specific time window and cannot connect outside it. High-risk sessions require a designated supervisor to accept the session before it proceeds (four-eyes principle). IP access must be fenced to whitelisted geographic ranges and named contractor addresses.

Article 21 §2.e — Network Security

Session recording must capture full keyboard, video, and mouse events — forensic-grade evidence, not connection logs. Open remote session protocols (RDP, VNC, Telnet, SSH) must be blocked at the network perimeter. All logging must occur at the entity level: the organization must own the audit trail, not the supplier.

Article 21 §2.h — Encryption

All remote sessions must use AES-256 encryption in transit. Key exchange must use Diffie-Hellman or RSA. Session recordings stored at rest must also be encrypted to a recognized standard.

Article 21 §2.i — Access Control

Anonymous access — including view-only sessions — must be eliminated. Every individual, whether an employee or an external contractor, must be positively identified before a session is established. MFA is mandatory for internet-facing systems, not an optional layer. Federated identity management must ensure departed personnel and expired contractors are revoked promptly.

Article 23 — Incident Reporting

Initial notification to national authorities is required within 24 hours of a significant incident. A full report is due within 72 hours. Session recordings, connection logs, and access event data must be tamper-proof, stored at multiple locations, and accessible at the entity level. Without this infrastructure in place before an incident occurs, the reporting deadlines cannot be met.

The forensic test: Can your current remote access tool prove exactly what a vendor did on a specific system at a specific time? Connection logs alone are insufficient for NIS2 Article 23 reporting. A full forensic session replay is required.

How Netop Addresses NIS2 Remote Access Requirements

Netop’s security architecture was built for environments where access control, audit depth, and operational continuity are non-negotiable. NIS2’s remote access obligations are addressed across the specific articles that govern supply chain security, incident reporting, and access control — not through compliance configuration layered on top of a product that was not designed for it.

Supply Chain Access Control

Most remote access platforms apply uniform access policies for all users, with minimal separation between employee and contractor access. Under NIS2 Article 21 §2.d, this is a structural compliance gap. Netop provides:

• Vendor-specific access policies: who can access what, when, from where, and for how long — defined per contractor, not per network segment
• Time-bound and just-in-time access: contractor authorisation expires automatically at the end of the authorised maintenance window
• Application-level restrictions: limits what a connected vendor can interact with during a session — not just which device they can reach
• Four-eyes principle: designated supervisor must accept high-risk sessions before they proceed
• Geo-fencing and IP-whitelisting: access enforced against named contractor addresses and geographic boundaries

Deployment and Data Sovereignty

Netop supports on-premises, cloud, and hybrid deployments, including self-hosted portal and private cloud (VPC) configurations. Netop’s cloud infrastructure operates on AWS within the EU — EU data residency for all session data, logs, and recordings. For organisations with data sovereignty requirements under NIS2, cloud-only architectures without EU data residency are not appropriate.

OT and Legacy Environment Support

NIS2’s scope includes industrial control systems, ATMs, medical devices, energy grid sensors, transport management systems, and embedded infrastructure. Most remote access tools are built for modern IT endpoints and do not operate in OT and legacy environments. Netop’s native support for legacy operating systems, embedded devices, and Intel vPro/AMT out-of-band management makes it one of the few remote access platforms with meaningful coverage across the full NIS2 device scope.

For organisations running Intel vPro-enabled infrastructure, Netop’s AMT integration extends access control and audit coverage to the hardware level, including One-Click Recovery: a secure, permission-controlled, fully audited remote restoration of a business-critical device without physical intervention.