EU Cybersecurity Regulations Force a Rethink of ERP Access Management

Access control in enterprise software was once a concern left almost entirely to IT departments. That changed when two major EU regulations moved from policy paper to enforceable law: the NIS2 Directive and the Digital Operational Resilience Act. Both demand that organisations take demonstrable, auditable control of who accesses what in their digital systems, including ERP platforms.

For the thousands of European businesses running Microsoft Dynamics 365 Business Central, these requirements hit close to home. The shared responsibility model governing cloud services means Microsoft secures the infrastructure, but the customer remains accountable for user access, role assignments, and data-level permissions. Regulators are no longer satisfied with vague assurances that the IT team has it covered.

Proper authorisation management has existed as a niche discipline for years, practised by specialists such as 2-controlware.com in Breda, who have worked on this challenge for over seventeen years. The regulatory shift is pulling it into mainstream compliance conversations. What used to be a best practice is rapidly becoming a legal necessity for organisations across the EU.

What NIS2 and DORA actually demand from organisations

The NIS2 Directive (Directive 2022/2555) replaced the original NIS framework and came with a transposition deadline of 17 October 2024 for all EU member states. It broadened the scope of covered sectors considerably, pulling in manufacturing, food production, waste management, and digital service providers alongside traditionally regulated industries like energy and transport. Organisations classified as essential or important entities now face mandatory risk management measures that explicitly include access control policies.

DORA (Regulation 2022/2554) applies specifically to financial entities and their ICT service providers and has been applicable since 17 January 2025. It sets detailed requirements for operational resilience, including strict rules around identity and access management within the ICT systems financial institutions depend on. Both regulations share a common thread: organisations must prove, not merely claim, that access to sensitive systems is controlled, monitored, and regularly reviewed.

Why ERP platforms sit at the centre of the compliance challenge

Enterprise resource planning systems typically house an organisation's most sensitive information, from financial records and supplier contracts to payroll data and customer details. A misconfigured user role in Business Central can expose payroll figures to someone in procurement or allow a single employee to both create and approve purchase orders. That second scenario is a textbook segregation-of-duties conflict, precisely the kind of risk that NIS2 and DORA target.

The difficulty lies in the sheer complexity of ERP permission structures. Business Central alone contains hundreds of permission sets, and organisations frequently layer custom roles on top of standard ones. Without dedicated authorisation tooling, keeping track of effective permissions becomes a spreadsheet exercise that falls behind reality within weeks.

Continuous monitoring of authorisation changes addresses this gap by flagging conflicts and role modifications in real time. In a regulatory environment that expects ongoing compliance rather than a single annual review, the distinction between periodic checks and continuous oversight is no longer academic. Solutions built specifically for the Business Central permission model, like the authorisation software offered by 2-controlware.com, have an advantage over generic identity management tools that lack the necessary ERP-level granularity.

Segregation of duties shifts from audit finding to regulatory obligation

Segregation of duties has featured in internal audit reports for decades, almost always surfacing as a recommendation rather than a hard requirement. Under DORA, financial entities must ensure ICT-related tasks and responsibilities are clearly separated to reduce the risk of unauthorised activities. NIS2 similarly expects risk management measures aligned to business functions, with access control named explicitly.

For IT managers and compliance officers, this means the informal approach of assigning roles by job title and trusting that conflicts will surface during an annual review no longer holds up. Regulators expect documented evidence of conflict detection and resolution, ideally in an automated and continuous form. Manual processes make it near-impossible to maintain a defensible audit trail across hundreds of users.

Organisations best positioned to meet these expectations are those that have already invested in authorisation software tailored to their specific ERP environment. Generic tools often cannot assess role conflicts within Business Central's layered permission model with sufficient precision to satisfy an auditor.

What technology decision-makers should weigh in 2026

The enforcement landscape is still taking shape. Several EU member states were late in transposing NIS2 into national law, and supervisory authorities remain at varying stages of operational readiness. Yet the direction is unambiguous: access control is now a regulated discipline, not an internal housekeeping task that can be deferred indefinitely.

Technology leaders evaluating their compliance posture should map current ERP access controls against the specific articles of whichever regulation applies to their sector. For financial services, DORA is the immediate priority. Organisations in the expanded NIS2 scope need to determine first whether they qualify as essential or important entities, a classification that determines both the obligations and the potential penalties.

The cost of implementing proper authorisation management within Business Central is modest relative to the reputational and financial exposure of a compliance failure linked to preventable access control weaknesses. With enforcement mechanisms gaining traction across the EU throughout 2026, the window for treating ERP access management as optional is closing.