Network security compliance requirements: controls shared across major frameworks

Compliance rarely fails because an organization has never heard of multi-factor authentication (MFA), encryption, or access controls. Rather, it fails in the cracks between these controls: when a contractor keeps access after an engagement ends, a VPN exposes more of the network than a user needs, or a security control exists on paper but cannot be backed up with evidence. NIS2, DORA, ISO 27001, PCI DSS, and HIPAA each tackle these gaps, and their requirements overlap more than their different terminology suggests.

Key takeaways

• Network security compliance frameworks differ in scope and terminology, but many converge on the same control areas: authentication, access controls, segmentation, encryption, device security, third-party access, and auditability.
• To achieve compliance, organizations need evidence that security controls are implemented, monitored, reviewed, and enforced.
• A business VPN alone does not provide sufficient network security compliance: flat network access can leave too many resources reachable after a user authenticates.
• Continuous monitoring, access reviews, device posture checks, tested incident response plans, and reliable audit trails help organizations prove that controls work in practice.
• NIS2 implementation varies by member state, DORA is moving into a more active supervisory phase, and the CRA and AI Act introduce important milestones through 2027 and 2028.

Network security compliance requirements that almost every framework cares about

NIS2, DORA, ISO 27001, PCI DSS, HIPAA, and SOC 2 are not interchangeable frameworks. They apply to different organizations, data types, risks, and jurisdictions. Their requirements also use different language: one may talk about cybersecurity risk management, another about technical safeguards, and another about control objectives.

But look beneath the terminology, and the same data protection principles appear repeatedly. Organizations need to know who is accessing their resources, what they can access, from which devices, and under what conditions. They need to protect sensitive data in transit, limit the impact of a compromised account or device, control third-party access, and maintain enough evidence to show that their controls work.

That convergence is useful when designing a security compliance program. There’s no need to build separate network controls for every regulation, as organizations can establish a strong baseline and map it to individual frameworks.

ENISA’s NIS2 technical guidance, for example, maps cybersecurity requirements to practical measures for the digital infrastructure, ICT service management, and digital provider entities covered by the relevant EU implementing regulation. The NIST Cybersecurity Framework offers a complementary reference for identifying, protecting against, detecting, responding to, and recovering from security risks.

Strong authentication and MFA

Strong authentication verifies that the person requesting access is who they claim to be. MFA adds another verification factor, reducing the risk that a compromised password alone can open network resources.

• NIS2, DORA, PCI DSS, ISO 27001, and SOC 2 all address authentication and access security, although they do not all require MFA for every access scenario in the same way. MFA is a common way to meet stronger authentication requirements.
• Auditors typically look for unique user identities, appropriate authentication for remote and privileged access, and evidence that shared credentials are prohibited or controlled.
• Enrollment, recovery, administrator access, and authentication policy changes should also be documented and reviewable.

Enforce MFA for remote, administrative, and other high-risk access paths, and combine it with SSO to centralize identity management. NordLayer supports 2FA and SSO as part of its access controls.

Least-privilege access controls

The principle of least privilege (PoLP) means users receive only the access they need to perform their roles—and nothing more. PoLP applies to applications, networks, systems, and data, not just user accounts.

• NIS2, DORA, ISO 27001, and HIPAA all contain requirements or control objectives around access management, authorization, and restricting access to authorized users. HIPAA, for example, explicitly requires technical access controls for Electronic Protected Health Information (ePHI) used by healthcare organizations and their business associates in the US.
• Auditors can examine role-to-resource mappings, access approval records, periodic access reviews, and evidence that access was removed when an employee or contractor left.
• A flat VPN is a common weak point: authenticating once and then gaining broad network reach does not align well with the principle of least privilege.

Move from network-wide access to resource-specific access based on identity, device, and context. NordLayer’s zero-trust network access (ZTNA) approach can help enforce access to specific resources instead of treating the entire network as trusted.

Network segmentation

Network segmentation divides infrastructure into separate security zones and limits communication between them. The objective is to prevent one compromised account, device, or workload from providing access to everything else.

• The NIS2 implementing regulation explicitly requires network segmentation for specified digital and ICT service entities. This involves separating critical systems, administration networks, and production environments from development and testing environments.
• PCI DSS—which consists of 12 core requirements for protecting cardholder data—uses segmentation as an important way to isolate cardholder data environments and reduce exposure.
• Auditors can look for documented network diagrams, defined segment boundaries, rules governing traffic between segments, and evidence that production, payment, administrative, and other sensitive environments are appropriately separated.

Instead of relying solely on a perimeter firewall, use segmentation alongside access policies. NordLayer can support this approach through its cloud firewall, virtual private gateways, and network access control capabilities.

Encryption in transit

Encryption in transit protects data while it moves between users, offices, applications, and other network resources. It helps prevent unauthorized parties from intercepting sensitive data as it crosses networks.

• GDPR, HIPAA, PCI DSS, and ISO 27001 all address the protection of information in transit, although the precise requirements and implementation expectations differ. HIPAA’s Security Rule, for example, includes transmission security safeguards for ePHI.
• Auditors can assess whether appropriate encryption is applied to relevant remote, internal, and site-to-site connections.
• They may also examine encryption configurations, protocols, cipher suites, key management, and whether unencrypted paths remain between systems handling sensitive data.

Encrypt network traffic using modern protocols and avoid relying on legacy or unprotected internal paths. NordLayer’s business VPN uses AES-256 and ChaCha20 mechanisms to protect data in transit.

Device posture checks

Authentication tells you who is connecting. Device posture checks help establish whether the device itself meets your security requirements before it receives network access.

• NIS2, DORA, and ISO 27001 all support risk-based controls around endpoint security, access, and secure operation, although device posture checks are an implementation mechanism as opposed to a universally named requirement.
• Evidence can include checks for supported operating systems and versions, security software, device configuration, and whether devices are rooted or jailbroken.
• Auditors may also look at what happens when a device fails a check: whether access is blocked, restricted, or remediated, and whether the decision is recorded.

Define a minimum device security baseline and prevent noncompliant endpoints from reaching protected resources. NordLayer’s device posture security can evaluate devices against predefined rules and block user access from noncompliant devices. CrowdStrike integrations can extend endpoint security visibility.

Third-party and contractor access

Suppliers, contractors, managed service providers, and other third parties can introduce security risks without being part of your workforce. Their access should therefore be treated as a controlled exception, not permanent network membership.

• DORA places significant emphasis on ICT third-party risk, while NIS2 addresses supply chain security, and ISO 27001 includes supplier relationships within its information security controls.
• Auditors should look for a current third-party inventory, documented ownership, and evidence that each supplier receives only the access required for its work.
• Time-bound access, approval records, periodic reviews, and prompt revocation after a contract or engagement ends are particularly important.

Use ZTNA to limit third-party access to specific resources, and use servers with a dedicated IP where allowlisting is required. NordLayer supports both approaches, allowing organizations to reduce the need for broad network access.

Access logging and audit trails

A security control is difficult to defend during an audit if you cannot show that it was enforced. Logging creates evidence of access, authentication, administrative actions, and other relevant network activity.

• DORA, NIS2, SOC 2, and HIPAA all include requirements or control objectives related to logging, monitoring, auditability, or the ability to detect and investigate security events. HIPAA’s Security Rule explicitly requires mechanisms to record and examine activity in systems containing ePHI.
• Auditors can review retention periods, log integrity, administrator activity, failed authentication attempts, and whether logs remain available when personnel change.
• The organization should be able to retrieve relevant evidence within the applicable reporting or investigation window.

Centralize access and administrative logs and integrate them with your broader monitoring and incident response processes. NordLayer’s Control Panel provides visibility into connections, actions, failed logins, and other activity, with logs available for export through Amazon Data Firehose to your SIEM.

Compliance deadlines to plan around through 2027

Compliance planning increasingly requires tracking several regulatory timelines at once. Some dates indicate a new obligation, while others mark a transition, enforcement phase, or national implementation step.

The practical lesson is simple: compliance is an ongoing operating model, not a date on the calendar. PCI DSS is a good example of this. Its future-dated v4.x requirements became effective on March 31, 2025, so organizations handling card payments should already be operating according to the current applicable requirements and preparing for annual compliance validation.

The cost of getting it wrong is real: GDPR penalties can reach €20 million or 4% of annual global revenue, and HIPAA civil monetary penalties, which are adjusted annually for inflation, can reach roughly $2.19 million per calendar year per violated provision, depending on the penalty tier. PCI DSS noncompliance can trigger penalties from payment brands, acquirers, or contractual partners, with amounts and enforcement measures varying by program.

Where network compliance programs usually fail

Even organizations with mature security policies can struggle when controls do not match how their networks operate.

• Flat networks behind a VPN. A user authenticates successfully, receives a VPN connection, and can then reach far more resources than their role requires. The VPN provides a secure tunnel, but not necessarily least-privilege access.
• Offboarding gaps. An employee can be disabled in the identity provider, yet a separate VPN account, gateway membership, certificate, or firewall rule could still provide access.
• Contractor sprawl. Temporary access gradually becomes permanent because nobody maintains a complete inventory of third-party identities, permissions, and expiration dates.
• Unmanaged and personal devices. Valid credentials do not make an endpoint trustworthy. Without device posture checks, compromised or outdated devices can become a direct route into protected resources.
• Policy without evidence. A written security policy does not prove that a control is working. Auditors need evidence: access reviews, configuration records, logs, remediation records, and proof that exceptions are handled.
• Untested incident response. A documented IR plan that has never been rehearsed rarely holds up under a real event, and most frameworks expect regular testing as part of compliance readiness.

These gaps matter for more than just compliance. They increase the probability that a stolen credential or compromised endpoint becomes a wider incident, potentially leading to data breaches, operational disruption, or unauthorized access to sensitive data.

A connected set of controls that work together across identity, network, and device is necessary to prevent them from widening.

Support compliance with NordLayer solutions

A strong network security compliance program starts with a framework, but it should not end with a collection of disconnected tools.

NordLayer brings several of the core security controls discussed above into one cloud-based platform. Organizations can combine MFA and SSO for stronger identity security, ZTNA and network segmentation for least-privilege access, business VPN for encrypted connections, and device posture security to keep noncompliant endpoints away from protected resources.

The cloud firewall adds another layer of network control, while activity monitoring provides visibility into connections, administrative actions, and failed logins. These capabilities can help organizations create evidence that their security policies are not only documented but actively enforced.

The goal is to establish durable security controls that address the underlying risks: unauthorized access, lateral movement, exposed sensitive data, compromised devices, and insufficient visibility—and then map those controls to the security requirements that apply to your organization.

NordLayer supports selected technical controls within the organization’s broader compliance program as regulations, cyber threats, infrastructure, and third-party relationships evolve. It covers many of the controls frameworks require, but audit success ultimately depends on how each organization runs its compliance program.

To see how NordLayer fits into your current frameworks, talk to our team.