Under NIS2, count the people who hold access, not the suppliers

When the EU's NIS2 directive brought providers of public electronic communications networks and services into its scope, most operators I know responded by extending what they already did. They updated security policies, refreshed supplier questionnaires and gave cyber risk a regular slot on the board agenda. We did the same at Lonmara in 2024, and for some months I thought it was enough. My position now is that the most useful thing a telecom operator can do under NIS2 is to count, by name, the people who hold privileged access to its systems, including those employed by its suppliers' subcontractors, and to show its board that number falling.

The directive asks something of the management body

NIS2 differs from the regime before it in where it places responsibility. It expects the management bodies of entities in scope to approve their cybersecurity risk-management measures, to oversee implementation and to be capable of being held liable for failures. It expects members of those bodies to follow training. It sets out staged reporting for significant incidents, beginning with an early warning within twenty-four hours of becoming aware of one. Each member state gives effect to the directive through its own law, and I would not describe the Irish detail beyond what our counsel has advised. The direction is clear enough. A board can no longer treat cyber risk as a report it receives from management.

That raises a practical question: what should a board look at to oversee measures it is now answerable for? Our first answer was a maturity score against a recognised control framework, presented quarterly, with a heat map of principal risks. Directors read it carefully and asked good questions. But a maturity score compresses hundreds of controls into a number that moves slowly, and it gave our audit and risk committee no way to see the thing most likely to hurt us.

A supplier register that stops at the contract

Among the measures the directive lists is security in the supply chain, including the relationships between an entity and its direct suppliers. We already kept a supplier register, as every operator does. It recorded 214 suppliers with access to our systems or data, each with a contract, a risk tier and an annual questionnaire. In early 2024 our security team tried a different exercise. Rather than asking which suppliers had access, they asked which people did.

The answer took eleven weeks to assemble and was uncomfortable. Across our systems, 1,140 named individuals held privileged access: the ability to change configuration, read customer records in bulk or alter billing rules. Of those, 236 were our employees. The rest worked for 63 suppliers, and 410 of them were employed not by the company we had contracted with but by its subcontractors, some two layers down. We found accounts for people our contracts did not mention, in countries our risk assessments had not considered, created for projects that had ended. Several predated the merger and had been inherited from both companies.

None of this was unusual. A merged operator runs on integrators, and integrators meet peaks of work through partners. Each layer is commercially rational. Together they mean that the security of a billing platform holding the bank details of most of our bill-paying customers rests partly on access decisions made by companies we have never met.

Counting people one layer down

We changed three things. First, privileged access now requires a named individual, an employer, a country and an expiry date, recorded in our identity platform; an account missing any of the four is suspended after fourteen days. Second, our contracts with principal integrators require them to tell us, before work starts, which subcontractors will hold access and for what purpose, and give us the right to refuse. Third, the audit and risk committee receives one number every quarter: people with privileged access, by type of employer, with the change since the previous meeting and the reason for it.

At June 2026 the number was 312, across 21 suppliers, and nobody on it worked more than one layer below a contract we hold. The change cost money. Two integrators repriced their support work because they could no longer staff it as flexibly, adding about €1.8 million a year. Some work now takes longer, because a new engineer cannot be given access the afternoon they arrive. Our programme teams complained, with reason, during the final waves of the billing consolidation.

The number is not a measure of security. A small population of privileged users can still include a careless one, and our monitoring, patching and recovery work continues behind it. But it is a measure a director can understand, test and follow over time. When the number rose in the first quarter of 2026, a director asked why, and the answer was a named project with a fixed end date. That is the kind of oversight I believe the directive intends: a board able to see a concrete exposure and to ask whether management is reducing it.

Some colleagues in the industry argue that this approach confuses a supply-chain risk with an identity problem, and that the directive's supply-chain expectations concern suppliers' security practices rather than the individuals they employ. I accept that a supplier's own controls matter, and we still assess them. My concern is that assessments describe intentions, while access records describe what is actually possible on a given day. A questionnaire tells you that a supplier has a process for joiners and leavers. An active account belonging to an engineer who left a subcontractor fourteen months earlier tells you whether the process worked.

My suggestion for any telecom board preparing to oversee its NIS2 measures is deliberately narrow. Ask management how many people can change your billing rules, read customer records in bulk or alter network configuration today. Ask how many of them you employ, how many your suppliers employ, and how many work for companies with which you have no contract at all. If management cannot answer within a month, that is the finding. If it can, ask for the number every quarter and expect it to go down.