Physical security starts where you mount it: from NIS2 to ISO/IEC 27002
NIS2 points to ISO 27002. Four of its physical controls describe your rack. What does an auditor see in yours?
Topic
When & Where
Details
Format:
Management lecture
Language:
English
Session description
Speaker: Robert van Zantvliet
Physical security is installed, not written
A firewall can be fully patched, sit behind multi-factor authentication and still be an audit finding, because it rests on a shelf with its power adapter dangling from a socket.
NIS2 never mentions a rack. Article 21(2) lists ten measures, and none of them is called "physical security". That is where most people stop reading, and that is the gap this session fills.
The detail sits one level down. Implementing Regulation (EU) 2024/2690 names it in section 12 of its Annex: supporting utilities, protection against physical and environmental threats, and physical access control. One level further down sits ISO/IEC 27002:2022. Chapter 7 holds fourteen physical controls, and four of them descri ...
