NIS2 access management audit program.
How to audit whether access rights are granted only to authorised people, reviewed regularly and withdrawn in time, including privileged accounts and multi-factor authentication.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation controls access to network and information systems through a documented and effective procedure: from the request through approval and provisioning to regular review and withdrawal. It also assesses whether elevated rights and remote access are additionally protected.
Scope
- Business applications, operating systems, databases, network components and administration consoles used for essential services or processes
- User accounts of employees, externals and service providers, as well as technical and emergency accounts
- Joiner, mover and leaver processes together with the HR department
- Out of scope: physical access and the authentication of customer accounts, unless agreed separately
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | An access control policy exists, is approved by management, is current and covers the systems, data and locations in scope. | NIS2 Directive Art. 21(2)(i); BSI ORP.4 | Read the policy, establish approval, version and date of the last review, and compare its scope with the system overview. | Policy with approval record and change history, system overview |
| 2 | Management is informed about access risks and supports the risk management measures. | NIS2 Directive Art. 20 | Review reports and minutes of the last twelve months for topics on access and authorisations. | Reports to executive management, meeting minutes, decisions |
| 3 | A role and authorisation concept defines which role receives which rights and follows the principle of least privilege. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 5.15 | For five selected applications, compare the concept with the rights actually granted and ask about deviations. | Role matrix, authorisation concepts per application, system extracts of rights |
| 4 | Owners are named for systems and roles and approve authorisations before they are granted. | BSI ORP.4 | Select ten access requests and check whether the responsible business owner approved them before provisioning. | Requests or tickets with approval and timestamp, list of owners |
| 5 | New accounts and rights for joiners match the request and the role. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 5.16 | Draw a sample from the HR joiner list and compare the rights granted with the request. | Joiner list, requests, extract of granted rights |
| 6 | When a person changes role, rights that are no longer needed are withdrawn. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 5.18 | Select role changes from the last twelve months and compare rights before and after the change. | List of changes, rights extracts before and after, tickets |
| 7 | Accounts of departed people are disabled promptly. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 5.18 | Compare the leaver list at a cut-off date with active accounts and determine the time between departure and deactivation. | Leaver list, account list with status and deactivation date, deactivation log |
| 8 | Authorisations are reviewed by their owners at defined intervals and findings are followed up. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 5.18 | Review the latest recertification: scope, response rate, deadlines and whether revoked rights were actually removed. | Recertification reports, confirmations by owners, tickets for removal |
| 9 | Privileged accounts are inventoried, limited to what is necessary and separated from day-to-day work. | BSI ORP.4; ISO/IEC 27001:2022 Annex A 8.2 | Extract privileged accounts directly from the systems, compare them with the inventory and check whether administrator accounts are used for email or internet access. | Inventory of privileged accounts, system extracts of administrator groups, approvals |
| 10 | Multi-factor authentication is used for remote access and privileged access; exceptions are justified and approved. | NIS2 Directive Art. 21(2)(j); § 30(2) no. 10 BSIG; ISO/IEC 27001:2022 Annex A 8.5 | Check the configuration of VPN, remote access and administration consoles and go through the exceptions with their justification. | Configuration extracts, list of exceptions with approval |
| 11 | Technical, service and emergency accounts are recorded, have a responsible person and a defined password procedure. | BSI ORP.4 | Derive service and emergency accounts from the systems and, for a sample, ask for the owner and the password procedure. | Inventory of technical accounts, procedure description, evidence of password change |
| 12 | Requirements for passwords and other authentication factors are defined and technically enforced. | ISO/IEC 27001:2022 Annex A 5.17 and 8.5 | Compare the defined rules with the settings in the directory service and central applications. | Policy, configuration extracts |
| 13 | Changes to authorisations and the use of privileged accounts are logged and reviewed. | ISO/IEC 27001:2022 Annex A 8.15 | Check logging for privileged activity and trace a review together with the response to a finding. | Log configuration, review results, alerts and tickets |
Documents to request
- Access control and authorisation policy
- Role and authorisation concepts, role matrix
- Inventory of systems and of privileged and technical accounts
- HR joiner and leaver lists for the last twelve months
- Reports of the latest recertification with follow-up
- System extracts of users, groups and administrator rights at a cut-off date
- Configuration evidence for multi-factor authentication and password rules
- Reports to executive management on access topics
Typical findings
- The review of authorisations does not take place, or is confirmed without checking the details.
- Accounts of departed people stay active for weeks because the notification from HR is missing.
- Privileged accounts are not fully inventoried; some administrators use their account for everyday work.
- Service accounts have no responsible person and a password that has not changed for years.
- Multi-factor authentication applies with unjustified exceptions, in particular for service providers.
- Roles are not documented; rights are granted by copying existing users.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing