Access control, multi-factor authentication and encryption: three measures the law names
The Cybersecurity Act and NIS2 name access control, authentication and encryption as parts of risk management. Least privilege, MFA and encryption at rest and in transit.
· 5 min read
In brief
Three measures prevent most data breaches, and the law names them all. Access control limits who reaches what; multi-factor authentication confirms that the person using an account is its owner; encryption makes data unreadable to anyone who reaches it without authorisation. Section 9 of the Finnish Cybersecurity Act requires access control and authentication procedures and policies on the use of cryptography, and Article 21 of the NIS2 Directive lists the same as minimum measures. In the public sector the Information Management Act adds task-based access rights and logging. None of these is merely a technical setting: each is a process with an owner.
What the law says
Section 9(2) of the Cybersecurity Act (124/2025) lists what a risk management model must at least cover and keep up to date. The list includes access control and authentication procedures (point 7), policies and procedures on the use of cryptography and, where necessary, measures for secure electronic communication (point 8), and personnel security (point 6). Article 21(2) of the NIS2 Directive correspondingly names policies and procedures on the use of cryptography and, where appropriate, encryption (h), human resources security, access control policies and asset management (i), and, where appropriate, multi-factor or continuous authentication solutions (j).
For the public sector the Information Management Act (906/2019) is more specific. Under section 16 the authority responsible for an information system must define its access rights according to the users' task-related needs and keep them up to date. Section 17 requires collecting the necessary log data on the use of information systems and on disclosures from them where use requires logging in; the logs' purpose is to monitor use and disclosures and to investigate technical faults.
Article 32 of the GDPR requires a level of security appropriate to the risk of the processing and names encryption as one measure. Article 34(3) gives encryption a concrete reward: if leaked personal data was protected so that it is unintelligible to outsiders, the data subjects need not be informed of the breach. The condition holds only if the encryption key has not leaked as well; that is why key management is part of encryption.
Access control: the principle of least privilege
The principle of least privilege means that everyone has access only to what their task requires. It sounds obvious and is rarely achieved, because rights are easier to grant than to take away. An ordinary organisation is full of access rights granted for a project that ended or a task the person moved on from.
| Lifecycle stage | What is done | Who |
|---|---|---|
| Start of employment | Rights according to the task from a role profile, not by copying the predecessor's rights | The supervisor requests, IT implements |
| Change of task | Old rights removed, new ones granted; nothing accumulates | Supervisor, HR |
| Regular review | Every system's rights are gone through and justified anew | System owner |
| Administrator rights | A separate account used only for administration, always with multi-factor authentication | IT |
| End of employment | All rights removed on the final day, automatically from HR's data | HR triggers, IT implements |
Our skills catalogue treats this as a level 4 skill for HR and IT, and the library course Access control and personnel security ends in a final task that resolves a least-privilege edge case between HR and IT. The edge case is usually a transition: a person covering two tasks, or a substitute who needs rights quickly. The supervisor's share in access rights is covered in A supervisor's data protection duty.
Multi-factor authentication
A password proves that the person logging in knows the password. It does not prove they own the account, because a password can be phished, guessed or bought from a leaked database. Multi-factor authentication adds a second factor the attacker lacks: a confirmation in a phone app, a key bound to the device or a physical token. A phished password is then useless without the second factor.
NIS2 says "where appropriate", and the risk assessment decides the need. In practice the assessment reaches the same conclusion: remote access, email, cloud services and all administrator accounts need a second factor, because they are attacked the most. The factors are not equal: a text message is better than a password alone but can be intercepted, an app confirmation is better, and a device-bound key that works only on the genuine site also withstands phishing in which the user types the code into a fake page themselves. What such a scam looks like is covered in Phishing and AI-assisted scams.
Encryption at rest and in transit
Encryption is two different things. Encryption at rest means stored data is encrypted: a laptop's disk, a phone, backups and cloud storage cannot be read without the key. It matters most when a physical device is lost, and Article 34 of the GDPR makes it the line that decides whether thousands of people must be sent a letter. Encryption in transit means data travels over the network encrypted, over TLS in web services and over a VPN for remote access, so that it cannot be read or altered on the way.
The Cybersecurity Act does not require encrypting everything but drawing up policies on what is encrypted and how. Level 4 of our skills catalogue for encryption and access control is exactly this: defines the requirements for encryption at rest and in transit and justifies the decision by risk. The library course Cryptography and encryption ends in a final task that resolves and justifies an edge case. Key management is the part most easily left undone: encryption whose key sits in the same place as the data protects nothing.
What these do not solve
Access control does not stop someone with a right from misusing it; that takes logs and their monitoring, which section 17 of the Information Management Act prescribes for the public sector. Multi-factor authentication does not stop a user from approving a confirmation request they did not initiate, if they do not know they must not; that takes training. Encryption does not protect data that is open and readable in the session of a logged-in user whose account has been hijacked. The three measures work together and with trained staff, and the law requires them all in the same section.
The information security officer's competence as a whole is described in What must an information security officer know under the Cybersecurity Act?, and what is done when the protections fail in Personal data breach.
Frequently asked questions
What does the principle of least privilege mean?
Everyone has access only to the data and systems their task requires, no more and no longer. Access is granted on the basis of the task, reviewed when the task changes and removed when the task or the employment ends. In the Finnish public sector section 16 of the Information Management Act says it directly: access rights are defined according to the user's task-related needs and kept up to date.
Is multi-factor authentication mandatory?
Point (j) of Article 21(2) of the NIS2 Directive names the use of multi-factor or continuous authentication solutions as a minimum measure where appropriate, and section 9 of the Finnish Cybersecurity Act requires access control and authentication procedures as part of risk management. The law does not name a technology, but a risk-based assessment practically always concludes that remote access, email and administrator accounts need a second factor. A password alone is no longer authentication but a guess that nobody has phished it.
What do encryption at rest and in transit mean?
At rest: stored data is encrypted so that a lost laptop, a backup tape or cloud storage cannot be read without the key. In transit: data travels over the network encrypted, for example over TLS or a VPN, so that it cannot be read on the way. Section 9 of the Cybersecurity Act requires policies on the use of cryptography, and Article 34 of the GDPR rewards encryption: data leaked in encrypted form need not be reported to the data subjects, provided it stays unintelligible to unauthorised persons, that is, the key is safe too.
Who is responsible for access rights when an employee leaves?
The supervisor knows the employment is ending and HR knows the date; IT removes the rights. If the chain breaks, the rights stay active, and the former employee or an attacker who obtained their credentials gets in. A process in which the end of employment triggers removal of rights automatically is the single most important access control, and it needs a named owner.