NIS2 and Building Technical Infrastructure: What Companies and Facility Managers Must Actually Do

NIS2 has attracted a lot of marketing noise, and it is easy to miss the basic point: the directive is not only about "cybersecurity" in the sense of firewalls and antivirus software. Physical security of infrastructure — access to server rooms, power, cooling, cabling — is explicitly part of the risk management the directive requires, along with the national legislation implementing it.

Who it applies to

The list of essential and important entities is broad: energy, transport, healthcare, public administration, waste management, selected manufacturing categories, digital services — and, indirectly through the supply chain, their subcontractors and service providers as well. In practice, NIS2 requirements cascade downwards: a company in scope starts imposing them on its suppliers, including the managers of the buildings it operates in.

The physical layer everyone forgets

The risk analysis NIS2 requires also covers physical scenarios: unauthorised access to technical rooms, power failure, fire in the server room, overheating. From a facility perspective this translates into a concrete list:

Access control to technical zones — named, with an event log that cannot be overwritten. A key hanging at the reception desk does not meet that requirement. Environmental monitoring of the server room: temperature, humidity, water leaks, smoke — with alerting, not just logging. Backup power with documented test results: a UPS whose batteries have not been tested in three years is a declaration, not a safeguard. Redundancy wherever the risk analysis calls for it: a second power source, two independent network paths, backup cooling.