Denmark's NIS2 law and what cloud-first companies have to evidence

Denmark's NIS2 implementation entered into force on 1 July 2025, with sector-specific rules layered on top for parts of the economy such as energy, transport, finance and telecommunications. Danish enterprise IT is unusually cloud-forward, and that creates a compliance shape that generic NIS2 advice handles badly.

The shared responsibility problem, stated honestly

If you run on hyperscale cloud and SaaS, your provider handles physical security, hypervisor integrity, and much of the platform patching. You still own identity, configuration, data classification, access grants, application logic, logging, and everything about how your people use the tools. NIS2 obligations follow the entity, not the infrastructure. A provider certification does not transfer your Article 21 duties.

What is actually testable in a cloud-first estate

Plenty. The misconception that cloud environments cannot be meaningfully tested comes from an outdated view of provider policy. Major providers permit testing of customer-owned resources under their acceptable use terms without prior approval, with specific carve-outs — typically denial-of-service testing, and anything targeting provider-operated infrastructure rather than your tenancy.

The three findings that recur in Danish cloud-first environments

1. OAuth and service principal sprawl

In mature Microsoft 365 and Google Workspace tenants we routinely find dozens of third-party applications holding consented permissions, several with tenant-wide read access to mail or files, granted years earlier by someone who has since left. These are supply-chain access grants in the NIS2 sense, and almost nobody inventories them. They are also trivially discoverable in a test — which means a supervisory authority's technical adviser can find them too.

2. Conditional access with a legacy exit

Policies look complete until you test the exclusions: break-glass accounts without hardware-bound authentication, service accounts exempted for an integration that was decommissioned, legacy authentication left enabled for one mail client. MFA coverage reported as 100 percent commonly tests at meaningfully less.

3. Backups reachable from the plane that gets compromised

Cloud-native backup is often configured inside the same identity boundary as production. If a tenant-wide administrative compromise is possible, so is deletion of the recovery path. NIS2's business continuity clause makes this a compliance matter and not only an operational one.

Supply chain security when your suppliers are SaaS vendors

Article 21 obliges you to address security aspects of relationships with direct suppliers and service providers, taking into account their specific vulnerabilities, the overall quality of their products and cyber security practices, and their secure development procedures. For a cloud-first company that is not a paper exercise about ten strategic vendors — it is an inventory problem across everything holding a token in your tenant.

1. Enumerate every third-party application with consented access, the permission scope, the grant date and the business owner.
2. Classify by blast radius: what could this application read, write or delete if the vendor were compromised?
3. Revoke everything without a current owner and a current business case. This alone usually removes the majority of grants.
4. For the remainder, get the assurance artefacts and record what you reviewed and when.
5. Test the highest-privilege integration path at least once, rather than assuming the documented scope matches the granted scope.

What defensible evidence looks like here

For a Danish cloud-first company, a credible first-year evidence pack is smaller than most consultancies imply: a scoped assessment covering identity, tenant configuration and your primary application; a supplier access inventory with revocation records; a verified backup isolation test; a retest of high and critical findings; and one timed incident exercise. Everything else can be policy, provided the policy points at something that was actually measured.