Evidence, on the day it is asked for
An auditor never asks whether you have a policy. They ask you to prove it worked on a Tuesday.
What the regulators ask for
None of these regimes mention a badge. All of them end up asking the same question.
| The regime | What it demands of physical access | What you put in front of the auditor |
|---|---|---|
| NIS2Essential & important entities | Physical access to the facilities that house your network and information systems is part of the required risk-management measures. Management is personally accountable for them. | Who held access to the server rooms and OT zones, who approved it, and the date it was last reviewed. |
| DORAFinancial entities & their ICT suppliers | Physical and environmental protection of ICT assets, extended to the third parties who work on them. | Contractor access to data halls, time-bound, approved by a named owner and closed on exit. |
| ISPSPort facilities & terminals | Restricted areas defined, identity verified for everyone entering, and records kept per the facility security plan. | Who entered which restricted zone, on which credential, and that the credential was valid at that moment. |
| Food defenceIFS · BRCGS · FSMA IA | Areas restricted to authorised persons, with contractors and visitors controlled at the identified vulnerable points. | Zone-level restriction per person, and contractors pre-qualified before they ever reach the floor. |
One page per regime
Nobody should hold a credential longer than they hold a reason. You should also be able to prove it on the spot.
Frequently asked questions
Does a platform make us compliant?
No, and we will not claim it does. Axxession produces the records these regimes ask for, who held access, who approved it, on what basis, and when it was last reviewed. Compliance is an organisational outcome that also depends on your policies, your people and your assessment.
Which regime should we start with?
Usually the one with a date attached. An audit finding, a supervisory request or a customer contract renewal gives you a scope, a deadline and a sponsor. Which is a far better first project than a general governance programme.
Can one platform serve several regimes at once?
Yes, and that is the practical argument for a governing layer. The same record answers an ISPS question about a restricted zone, a DORA question about a supplier and an internal question about a leaver. No separate exercises.
Start with 1 site and 1 population.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay