NIS2 does not mention a badge. It requires that the facilities housing your network and information systems are protected as part of the required risk-management measures. It also makes management personally accountable for them.
The measures cover physical and environmental security of the facilities housing network and information systems. Server rooms, comms rooms, OT zones and control rooms are in scope alongside the logical controls that get most of the attention.
NIS2 puts approval and oversight of the risk-management measures on the management body. That changes the question from whether a process exists to whether someone can show it worked. Which is a documentation problem before it is a technology problem.
Supply-chain security is explicit. The engineers, integrators and service providers who physically reach your systems are part of what you govern and evidence. They are not an exception to it.
An auditor asks when access was last reviewed and by whom. Access that was granted correctly in 2021 and never revisited is a finding, however good the original approval was.
Unmanned sites, provable entry
Find out more
A network with nobody standing by
Find out more
Only trained people, inside the unit
Find out more
Provable access, rack by rack
Find out more
A whole cohort moves, and access follows
Find out more
Axxession gives you the records NIS2 asks for, ready to show an auditor. Compliance itself also rests on your own policies, risk assessment and controls. Nothing here is legal advice.
NIS2 requires appropriate technical, operational and organisational risk-management measures, and the physical and environmental security of facilities housing network and information systems falls inside them. It does not prescribe a badge technology; it requires that the risk is managed and that management can account for it.
Typically, who held access to the server rooms and OT zones over a given period, and who approved each grant on what basis. They also ask when access was last reviewed. Producing that from several separate access control systems after the fact is where most organisations struggle.
Yes. Supply-chain security is an explicit part of the measures. Third parties who physically reach your systems are governed alongside your own staff, and never handled as an exception.
You judge something that runs on your own site. Your access systems and readers stay where they are. If it earns its place, we extend it site by site.
One siteOne populationYour readers stay