Without evidence, security remains an assertion

By Markus Stadelhofer, Consultant OT Cybersecurity at Primion

Firewalls, access cards, cameras and security portals: data centres invest heavily in security. But NIS2 brings a different question into focus: in the event of an incident, can operators prove that everything worked as intended? Alongside technical protection, one thing is essential: reliable evidence that security measures are effective.

Data centres are high-security environments and are classified as essential entities under NIS2 as part of the digital infrastructure sector. As a rule, operators are affected if they have at least 50 employees or annual revenue of €10 million. For certain services, such as DNS or trust services, the requirements apply regardless of company size.

Unauthorised access puts more than hardware at risk. Data, applications and business-critical processes may also be exposed. Physical protection measures are therefore standard practice. NIS2, however, ends the regulatory separation between cybersecurity and building security. The Directive follows an “all-hazards” approach: what matters is not whether a threat is digital, physical or environmental, but whether it puts operations at risk. From a regulatory perspective, the door to a server room is therefore subject to the same security logic as access to a network.

The question that follows “Who is allowed in?”

Access control determines who may enter which areas. A reliable chain of evidence must also document when access occurred, on what basis it was granted, who authorised it and how anomalies were handled.

The regulatory focus is therefore less on a particular application and more on robust evidence. The system itself is not what counts; what matters is proof that the intended controls were effective.

Abundant data, an incomplete chain of evidence

A data centre continuously generates security data. Access-control, identity and alarm systems record events; an external service provider, for example, may be granted access for a limited period. Data is rarely in short supply. What is often missing is the link between records that would create a meaningful overall picture.

After an incident or during an audit, existing records must quickly form a coherent account: Who was on site? What authorisation did they have? Was an alarm triggered, and when was a response made?

If this information first has to be assembled from different systems, spreadsheets, emails and manual records, a functioning security structure can quickly turn into an incomplete chain of evidence. In an emergency, the clock is ticking: NIS2 requires an early warning within 24 hours and a full report after 72 hours for significant incidents. Organisations that have to search for their data only after an incident may be unable to meet these deadlines.

Compliance starts with day-to-day operations

NIS2 connects risk management, supply-chain security, the reporting of security incidents and the responsibility of company management. The common thread is traceability: organisations must not only define controls, but also document their implementation.

This is particularly clear when external personnel regularly need access to critical areas. Who requested and approved access? How long is it valid? Is the permission revoked afterwards, and is its use documented?

An access right becomes a controlled lifecycle. Well-organised processes generate the necessary evidence as part of everyday operations. Audit readiness is then not a short-term project, but the result of effective processes.

Silos become a security risk

In many organisations, access, video, alarm and identity data are held in separate systems. That may work during normal operations. But when events need to be assessed quickly and reconstructed in full, the separation becomes an obstacle.

The focus is also shifting in critical-infrastructure environments from individual protective measures to integrated security architectures. Physical security, IT and OT security, and business continuity become one. For data centres, the principle is clear: a security chain is only as robust as its chain of evidence. Anything that cannot be assigned organisationally or retrieved in time will remain incomplete in an emergency.

Physical security becomes a leadership issue

The physical security of a data centre is no longer solely the responsibility of facilities management, site security or security operations. As soon as data availability, information security or regulatory obligations are involved, it becomes a governance issue.

NIS2 expressly makes management responsible. Management must not only approve and oversee risk-management measures, but is also legally required to undertake regular cybersecurity training.

In the event of non-compliance, companies face fines of up to €10 million or two per cent of global annual turnover. Senior management may also face personal, uninsured liability extending to their private assets.

Security leaders must be able to demonstrate plausibly how technical and organisational measures work together and how their effectiveness can be evidenced.

In an emergency, the decisive factor is not how many security systems a data centre operates. What matters is whether it is possible to establish without gaps who had access, what happened and how the organisation responded.

Security without evidence is not compliance. And it may not be security.

NIS2 in the data centre: what matters

Risk management: Physical and environmental risks must be considered alongside cyber threats.

Access records: It must be possible to establish who received access, when, to which area and on what basis.

Permission management: Approvals, changes and revocation of access rights should be documented throughout.

External service providers: Time-limited access rights for maintenance firms, suppliers and service technicians must also be controllable and verifiable.

Reporting security incidents: Significant incidents must be detected, assessed and reported within the specified deadlines.

Management responsibility: Management must approve risk-management measures and oversee their implementation.

The decisive factor is not only which security systems are in place. Operators must be able to prove that the intended controls are actually effective.