[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nis2\u002F21-2-i":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nis2","21-2-i","Article 21(2)(i)","Human resources security, access control and asset management (Article 21(2)(i))",0,"Directive (EU) 2022\u002F2555 (NIS2)","**What it asks for.** Point (i) requires measures on human resources security, access control policies and asset management. It links the people who use systems, the rights they have and the assets they use.\n\n**In practice.** The entity screens staff where appropriate, sets security duties in contracts, and runs joiner, mover and leaver processes that grant and revoke access promptly. Access control follows least privilege with periodic reviews, and asset inventories identify owners and criticality. Evidence includes HR procedures, access review records, leaver reconciliations and asset inventories.\n\n**Common gaps.** Access is often not removed promptly when people leave or change role, particularly for contractors. Asset inventories are incomplete, so access control and ownership cannot cover everything that matters.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32022L2555#art_21","Read the official text on EUR-Lex","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]