NIS2 compliance: what a physical security partner can contribute

Lees dit artikel in het Nederlands

Your organisation falls under NIS2, the CISO team has carried out a risk assessment and the list of measures is long. Between the points on network segmentation and back-ups there is also something about physical access to systems. In NIS2 compliance projects, that is often the part nobody feels they own, even though it is visible to anyone walking past the fence.

1Why physical security is part of NIS2 compliance

The European NIS2 Directive, implemented in the Netherlands through the Cybersecurity Act (Cyberbeveiligingswet), requires organisations in essential and important sectors to manage their risks. That is not just about software. A server room anyone can walk into, an unmonitored pumping station or a roadside switch cabinet are just as much a way into systems you need to protect. The directive explicitly names the physical environment as part of the security of network and information systems.

Regulators such as the Dutch Authority for Digital Infrastructure (RDI) look not only at whether you have measures, but also at whether you can show that they work. On the physical side that means: do you know who has been on a site, can you show what happened during an incident, and do you have an overview of the sites that matter?

2What a physical security partner can contribute

A physical security partner can supply part of the evidence you need. In concrete terms, it comes down to four things:

• Recording access: who came in, when and through which entrance, including at sites without permanent staff.
• Capturing footage: camera surveillance that shows what happened when an alert goes off, with a fixed retention period.
• Passing on alerts: an anomaly on site reaches the party responsible for response, and is recorded.
• Keeping track of technical condition: a camera or detector that fails is itself a risk. A partner that monitors its systems will spot that sooner than you.

That information also helps with the reporting obligation. In the event of a significant incident you have to report quickly and later explain what happened. If the incident started at a site, you will already have the footage and records to hand.

3What you cannot outsource

A partner can support your NIS2 efforts, but it does not make you compliant. Responsibility lies with your board, and you cannot pass it on. Your risk assessment determines which sites need which measures. Your own policy determines who gets access. And your incident process determines what happens with an alert.

NIS2 also requires attention to your suppliers. A partner that manages cameras or access systems at your sites becomes part of your supply chain. So ask how that partner handles access to footage, where the data is stored and how the systems’ connectivity is set up. A camera system that runs over your own corporate network can become a new way in. A separate connection prevents that.

4An example from practice

Think of a grid operator that needs a series of distribution substations to meet its own NIS2 measures. Some of the substations are being renovated, so contractors are on site for weeks at a time. At each substation, one or two mobile camera towers are placed, along with temporary access registration at the construction entrance. The connection runs separately from the grid operator’s network. When a renovation is finished, the security department has an overview of who was at which substation, with footage for every alert. That goes into the file for the internal audit.

5How Darwin fits in with NIS2

We start with your risk assessment, not with our products. Which sites are critical, which are temporarily more vulnerable and what do you need to be able to demonstrate? We tailor our deployment to that, with camera surveillance from Darwin Site Security and registration through Darwin Access Control. The systems use their own connection, separate from your corporate network.

Darwin monitors the technology 24/7 and keeps track of when a system fails or behaves abnormally. For response, you can choose between your own monitoring centre and that of our regular partner. Read how we handle procurement questions and the requirements clients set for us as a supplier under procurement and compliance.

6Frequently asked questions

Am I NIS2 compliant if I have camera surveillance?

No. Camera surveillance and access registration are measures that support NIS2. Compliance depends on your whole approach, from risk assessment to incident process and board accountability.

Does my security partner count as a supplier under NIS2?

Yes, if that partner manages systems at your sites. Ask about access to footage, data storage and how the connectivity is set up.

Does physical security help with the reporting obligation?

Yes. If an incident starts at a site, footage and access records give you the information to report what happened and when.