The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →For organisations preparing for NIS2, the most practical low-cost credential safeguards are to map identities, promptly disable accounts no longer needed, restrict shared accounts, separate administrator accounts from everyday use, prioritise multifactor authentication (MFA) for privileged access, protect authentication secrets, and train staff. These steps translate relevant controls into an actionable starting point; they are not a universal compliance checklist or a legal safe harbour.
What NIS2 requires for passwords and MFA
NIS2 is Directive (EU) 2022/2555, implemented through Member State laws. Its risk-management measures include access-control policies and, where appropriate, multifactor authentication or continuous authentication. The specific obligations depend on an organisation’s scope and applicable national law. The European Commission’s Implementing Regulation (EU) 2024/2690 sets technical and methodological requirements for specified digital infrastructure, digital provider, and ICT service management entities; its requirements should not be assumed to apply identically to every organisation covered by NIS2.
As an Amazon Associate I earn from qualifying purchases.
For entities within its scope, the regulation addresses access control and secure authentication. Authentication strength should match the classification of the asset. Privileged and system-administration accounts require strong identification, authentication—such as MFA—and authorisation procedures. The regulation does not prescribe one MFA product or require a password manager.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallENISA’s Technical implementation guidance, version 1.0, published in June 2025, offers implementation context, not binding law. ENISA states: “This document is not legally binding and is only of an advisory character.” Check the transposing law and competent authority guidance for the relevant Member State and sector before treating any measure as an obligation.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Seven low-cost steps to secure credentials
1. Inventory identities and accounts
Make a working list of the people and non-human identities that can access your systems: employees, administrators, contractors, suppliers, service accounts, and other system identities. Record which systems and data each identity can reach, what level of access it has, who owns it, and why it is needed. Include cloud services and remote access, not just accounts managed on company devices. This inventory gives you a basis for reviewing and removing access.
2. Disable accounts that are no longer needed
Build account removal into employee departures, contractor end dates, supplier changes, and role transfers. Assign responsibility for disabling access and confirm that it is removed from relevant services, not only the central identity system. Schedule periodic reviews to catch accounts that bypassed or outlived the normal process. The regulation says identities no longer needed should be deactivated without delay.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
3. Make shared accounts the exception
Use individual accounts where practical so activity can be attributed to a person and access can be removed without disrupting others. If a shared identity is operationally necessary, make the reason explicit, obtain approval, document who may use it, and set a review or retirement point. Keep its credentials protected and change them when someone who knew them no longer needs access. A shared login should not become a convenient substitute for individual access management.
4. Separate administration from everyday work
Give administrators dedicated accounts for system administration rather than using highly privileged accounts for email, browsing, and routine tasks. Keep privileges limited to what each person needs and use administrative access only for administrative work. This reduces the exposure of powerful credentials during ordinary activity and makes high-impact access easier to identify and review.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Prioritise MFA for privileged access
Start with administrator and other privileged accounts, including those used to manage cloud services, identity systems, backups, and security tools. For accounts subject to Implementing Regulation 2024/2690, strong authentication such as MFA is specifically addressed. Expand MFA to other accounts according to risk and asset classification, especially where an account can reach sensitive data or critical systems.
Choose methods by checking phishing resistance, compatibility with the identity systems and services you already use, recovery and lockout procedures, administrative visibility and revocation, setup and per-user cost, and usability for employees, contractors, and emergency access. A FIDO2 hardware security key can be an option for compatible accounts, but only where the service supports it; it is not an NIS2-mandated item. Plan how to replace lost or compromised factors without creating an easy bypass.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Protect authentication secrets throughout their lifecycle
Define how passwords, recovery codes, keys, and other secret authentication information are issued, stored, recovered, and revoked. Limit who can access them, keep them confidential, and provide a safe way to replace credentials when compromise is suspected. A business password manager may help an organisation implement controlled storage and sharing, but the regulation requires confidential management of secret authentication information—not a particular tool.
7. Train staff on the credential risks they actually face
Include credential handling and basic cyber hygiene in staff instruction, as NIS2 identifies basic cyber hygiene and cybersecurity training among risk-management measures. Make the guidance specific: how to recognise a suspicious sign-in request, where to report suspected phishing, how to approve or reject MFA prompts, and how to handle passwords and recovery codes. Tailor examples to the services and account types people use, including contractor and administrator workflows.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Turn the steps into a proportionate work plan
These actions can be prioritised without buying a new platform first. Use the identity inventory to find high-impact access, assign owners to unresolved accounts, and document decisions about exceptions and recovery. Then compare available MFA and credential-management options against your current services and support capacity. A lower-cost choice is only useful if staff can use it reliably and the organisation can revoke access and recover accounts safely.
Assess the resulting controls against your organisation’s assets, risks, sector, applicable national transposition, and regulator guidance. NIS2 and Implementing Regulation 2024/2690 have scope-dependent application; completing these seven steps alone does not establish compliance.
Quick Recap
Sources and scope
- Directive (EU) 2022/2555 (NIS2), Article 21
- Commission Implementing Regulation (EU) 2024/2690
- ENISA, Technical implementation guidance, June 2025, version 1.0
- ENISA, NIS Directive 2
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
