NIS2 Compliance: What Data Centre Security Teams Need to Show

NIS2 is often read as cybersecurity legislation, and much of the coverage treats it that way. For teams running a data centre, the framework also reaches the physical floor: who can access which area, how that access is documented, and who is accountable for it. This piece explains what falls in scope, what the regulation actually asks for, and why physical security ends up part of the conversation at all.

Key Takeaways

• NIS2 classifies organisations as essential or important entities by sector and size, with data centres explicitly named under Annex I and further detailed by EU Implementing Regulation 2024/2690. 
• These four requirements are deliberately broad. NIS2 describes outcomes it expects an organisation to achieve, rather than prescribing a specific technical control for every scenario. 
• NIS2’s all-hazards approach means physical and environmental risks fall under the same risk management obligation as cyber risks, not a separate category. 
• Across risk management, supply chain security, incident reporting, and governance, the common thread is documented evidence, not just a stated control. 
• Physical security documentation is not a separate compliance project. It sits inside the same four obligations every classified organisation already has to meet, never appearing as its own separate line item. 

Who Falls Under NIS2 and How Classification Works

NIS2 classifies organisations as either “essential” or “important” entities, based on sector and size, with data centre services explicitly named within the digital infrastructure sector under Annex I. The EU Commission’s Implementing Regulation 2024/2690 adds sector-specific detail for digital infrastructure providers, including data centres, on top of the general NIS2 requirements. Classification is not a one-off form to fill in. It determines which specific obligations, reporting deadlines, and levels of scrutiny an organisation is actually held to. For a security or operations lead, understanding where a facility sits in this classification is the starting point for everything else in this piece, since the details that follow scale with it.

What NIS2 Actually Asks Organisations to Do

At a high level, NIS2 asks classified organisations to do four connected things. First, maintain a risk management process that covers the organisation’s actual operational risks, not a generic template. Second, manage supply chain security, meaning visibility into the risk posture of suppliers and service providers an organisation depends on. Third, follow incident reporting obligations, with early warning and full notification requirements that start counting from the moment an incident is detected. Fourth, ensure management accountability, with governing bodies expected to approve and oversee the organisation’s risk management measures directly, not delegate the topic entirely to a technical team. These four requirements are deliberately broad. NIS2 describes outcomes it expects an organisation to achieve, rather than prescribing a specific technical control for every scenario. That breadth is precisely why the regulation, on a first read, can look like it is only about IT systems, and precisely why it turns out not to be.

Why a “Cyber” Regulation Reaches the Physical Floor

NIS2 takes what it describes as an “all-hazards” approach, meaning the risk management process it requires must account for physical and environmental threats alongside cyber ones, not treat them as separate categories. For a data centre, this means the same risk management obligation that covers network security also covers who can physically enter a server room, how that access is granted, and how it is recorded. A locked network port and a locked door are, under this approach, two instances of the same underlying question: was access controlled, and can that control be shown to have worked? This is also where the EU’s data centre-specific Implementing Regulation adds detail, since it explicitly extends risk management and documentation expectations into physical facility security, rather than leaving it as an assumed but unstated requirement.

What “Documented” Means in Practice

Across all four of NIS2’s core requirements, one expectation repeats: organisations need to be able to show that a control was applied, not simply state that it exists. For risk management, this typically means a recorded assessment and a trail of decisions taken in response to it. For incident reporting, it means being able to demonstrate that detection and notification actually happened within the required timeframes. For physical security specifically, this generally extends to being able to produce a record of who had access to a given area, when, and on what basis, on request rather than after a lengthy reconstruction process. The regulation is less concerned with which specific tool or process an organisation uses, and more concerned with whether that organisation can produce evidence when asked. This is the thread that connects a network access log, a supplier risk assessment, and a physical entry record: each is, in NIS2’s terms, evidence of a control having worked.

Where This Leaves Security and Operations Teams

For a facility manager, head of critical operations, or CISO working on data centre security, this leaves a fairly consistent starting point regardless of exact job title: confirm where the facility sits in NIS2 classification, understand which of the four core obligations apply in most detail, and identify where physical security documentation currently sits relative to what an audit would actually ask for. Look across all four obligations and physical security never shows up as its own separate line item, because each one already assumes it’s folded into how risk, suppliers, incidents, and governance get documented. Translating that into concrete, floor-level actions, rather than another layer of policy, is where the practical work actually begins.

Get evidence-ready

See how to turn fragmented access, alarm and identity records into one governed evidence chain, ready for any regulator, tenant or auditor.

Download Whitepaper

Conclusion 

NIS2 starts from cybersecurity language, but the obligations it sets out, risk management, supply chain oversight, incident reporting, and governance, reach further than most first readings suggest, including into how physical access is controlled and documented. The practical next question for most security and operations teams is not whether this applies, but where their current documentation already meets it, and where it doesn’t.

Frequently Asked Questions

Does NIS2 apply to physical security, or only to cybersecurity?  

NIS2 takes an all-hazards approach, meaning its risk management requirement explicitly covers physical and environmental threats alongside cyber ones. For data centres, the EU’s Implementing Regulation 2024/2690 adds further detail specific to physical facility security. 

What are NIS2’s four core requirements, in simple terms? 

At a high level: a risk management process covering actual operational risks, oversight of supply chain and supplier security, incident reporting within defined timeframes, and direct management accountability for approving and overseeing these measures. 

What does “documented” mean across these different NIS2 requirements?  

It means being able to produce evidence that a control was applied, not just state that a policy exists. This applies equally to a recorded risk assessment, a supplier security review, an incident notification, and a physical access record.