Most critical infrastructure sites still operate in silos: IT defends against network breaches, physical security guards the perimeter, and procurement handles company and contractor onboarding.
The EU’s regulatory framework no longer treats those as separate worlds.
Between NIS2 (Directive (EU) 2022/2555) and the Critical Entities Resilience Directive (CER, Directive (EU) 2022/2557), physical perimeters and digital supply chains have legally converged. NIS2 regulates your networks and the physical environments that house them. CER covers physical resilience and who enters critical facilities, explicitly including staff of external service providers.
Who is this for?
The directives overlap, but they are not identical. NIS2 applies to essential and important entities under your national NIS2 rules. CER resilience duties apply once your Member State identifies and notifies you as a critical entity.
Why now?
Member States had to identify critical entities under CER by 17 July 2026 and notify them within one month. For those entities, Chapter III usually starts 10 months after notification, with a risk assessment due within nine months. At the same time, October’s cyber shock week, already being called Black October, pushed “are we exposed?” up board agendas. For critical sites, that question includes who can walk up to those systems.
Together, the directives pose a direct operational question: Can you prove, in real time, that only vetted people have access to your critical zones?
Official sources: NIS2 · CER · Commission guidance on CER Article 13 measures · Commission overview of critical infrastructure resilience
NIS2 vs CER
NIS2 and CER were built to complement each other. On a plant, terminal, or data centre that sits under both, they meet at the gatehouse, where cyber risk and physical access collide.
NIS2: securing the physical environment of digital assets
Under Article 21, essential and important entities must take appropriate and proportionate technical, operational, and organisational measures to manage cybersecurity risks. For site and plant directors, three duties stand out:
- Physical environment security: Measures must protect network and information systems and the physical environments that house them, for example server rooms, OT control hubs, and related technical spaces.
- Human resources security and access control: Article 21 also requires policies on human resources security, access control, and asset management. Who may enter which space, with which credential, and for how long sits here as much as in “cyber” tooling.
- Supply chain security: Organisations must consider security-related aspects of relationships with direct suppliers and service providers. When an external technician, haulier, or maintenance contractor can reach a plant floor where OT systems operate, their presence is part of the same risk surface: supplier relationships plus access control for the people who actually arrive.
CER: operational resilience and external personnel
Under Article 13, designated critical entities must take appropriate and proportionate technical, security, and organisational measures for resilience. In practice, that includes:
- Perimeter and physical defence: access controls, detection equipment, and perimeter monitoring tools and routines (examples named in the Directive itself).
- People security for external staff: Article 13 requires critical entities to manage personnel security for critical roles, and to take into account staff of external service providers. That means clear access rights, identity checks, background-check categories where required under Article 14, training where relevant, and the ability to grant and revoke access.
The operational overlap
| NIS2 (Directive (EU) 2022/2555) | CER (Directive (EU) 2022/2557) | Gatehouse reality | |
|---|---|---|---|
| Core objective | Protect IT/OT systems and manage supplier risk | Keep critical services resilient through physical protection and people controls | Stop unauthorised physical access from becoming an operational or cyber failure |
| Physical scope | Systems and the spaces around them | Fences, barriers, monitoring, detection, zoned entry | Turnstiles, gates, server-room locks, controlled zones |
| Third-party scope | Direct suppliers and service providers | Contractors and other external service provider staff | Every external worker asking for gate clearance |
| Typical owner | CISO / IT / OT | Physical security / HSE / facilities | Gatehouse / reception / security ops |
| Shared failure point | Unvetted third-party access near systems | Unvetted person crosses the perimeter | An unverified person passes with a badge that no longer matches reality |
Three real-world failure points in industrial site access
Compliance breaks down when office policy does not match live gate operations.
Scenario A: Cleared driver, unvetted passengers
A truck driver arrives with pre-approved paperwork, verified identity, and a valid clearance.
The gap: Other people are also in the cab: family members or colleagues who were never vetted.
The failure: The barrier accepts the driver’s credential and opens. The access system logs one valid entry. Cameras see three people entering a secure zone. Because vision and credentials do not talk to each other, unvetted people enter undetected.
Pre-checks answered one question: was this driver cleared? They did not answer: is everyone in this vehicle allowed on site?
Scenario B: Low-risk contractor in a high-risk zone
An external technician is cleared for work in an office or low-risk block.
The gap: The site uses broad visitor or contractor badges without enforced zone limits.
The failure: The person walks into a server room, OT area, or other critical zone. Both frameworks push toward least privilege: contractor clearance should match the job, the zone, and the time window, not “approved for the whole site for the day.”
Scenario C: Approved company, unknown people at the gate
Procurement completes a security questionnaire on the main contractor. The company is marked approved and filed.
The gap: The work is handed down to a subcontractor. The people who will actually arrive were never onboarded, vetted, or added to site clearance.
The failure: At 06:30, three workers show up with IDs on paper or in a chat thread. The queue is long, so the gate improvises a manual sign-in. On paper the main contractor is “approved.” In reality, nobody checked the individuals standing at the barrier.
CER people-security rules focus on external staff in critical roles, not only the company name on the purchase order. NIS2 access-control and supply-chain duties depend on the same point in practice: company verification has to reach the people who enter, not stop at the tier-1 file.
What integrated site resilience looks like in practice
Neither directive names a single vendor stack. Passing an audit does not mean ripping out every turnstile. It means connecting the decision layers you already have so policy matches live gate behaviour.
Upstream
Digital onboarding, vetting, document expiry, zone/time rules
At the perimeter
Physical access control, cameras, real-time zone match, instant hold/revoke
Audit trail
One log: who, company, where, when, what was checked
- Upstream pre-clearance. Companies and workers submit identity, certificates, and inductions before they travel, including document checks that can expire credentials when papers lapse.
- Zone and time limits. Clearance is for specific areas and windows, not the whole site by default.
- Vision + credential interlocking. If cameras or gate systems see something that breaks the clearance (extra passengers, tailgating), the barrier can stay closed or access can be revoked.
- Immediate revoke. When a certificate expires, a contract ends, or a blocklist / watchlist flag appears, credentials stop working across the access system.
- One audit record. Company checks, person checks, credential status, and gate events in one exportable trail.
Site access self-audit checklist
In an inspection or incident review, you should answer these without digging through email or paper logs. Each item maps to how the directives and Commission guidelines talk about people, premises, and proof:
- Critical roles and zones. Have you mapped critical zones (OT, utilities, cleanrooms, control rooms) and which external roles may enter them? (CER Art. 13 people security + physical protection; Commission guidance on zonal access.)
- Upstream vetting. Are companies and the actual on-site people checked before arrival? (CER external service-provider staff; NIS2 supply chain + access control.)
- Least-privilege credentials. Are badges limited by zone and time, or do they open the whole facility? (Commission Art. 13 guidance on least privilege; NIS2 Art. 21 access control.)
- Expiry controls. Does access stop when a certificate, permit, or required check lapses? (Fast revoke of credentials; CER people security; NIS2 access control.)
- Perimeter + gate integration. Can detection (extra cab passengers, tailgating) hold or revoke clearance automatically? (CER perimeter monitoring and access controls in practice, not a named camera mandate.)
- Audit-ready reporting. Can you export who is/was on site (company, credentials, entry/exit) within minutes? (Logged access encouraged in Commission guidance; evidence for both regimes.)
Example: how an integrated stack looks in practice
The directives do not prescribe a single vendor. They describe an outcome: identity decisions upstream, enforcement at the perimeter, and one proof trail. In practice that usually means connecting a digital access layer to the cameras and barriers already on site.
Take 9ID and Axis Communications as a concrete stack. 9ID handles company and person onboarding, document expiry, zone/time clearance, and the audit record. Axis covers cameras, analytics, and physical access hardware at the gate. When those layers share a live decision (for example, credential valid but cabin occupancy does not match), the barrier can hold or revoke instead of logging a false “cleared” entry.
From paper policy to enforced perimeter control
NIS2 and CER shrink the gap between a policy PDF and what happens at the barrier. Static vendor questionnaires and paper visitor logs are weak evidence when the question is live access to critical zones.
The practical bar is clearer than the legal language sounds: verify upstream, enforce at the gate, connect detection to decisions, keep one proof trail.
That is how physical access becomes part of cyber supply-chain risk, not a separate silo beside it.
FAQs
What is the difference between NIS2 and the CER Directive?
NIS2 (Directive (EU) 2022/2555) is the EU cyber rulebook for essential and important entities. It covers systems, the physical spaces around them, supplier risk, and access control. CER (Directive (EU) 2022/2557) focuses on resilience of designated critical entities, including physical protection, perimeter monitoring, access controls, and people security that includes external service providers. The two regimes overlap in practice but are not the same list of organisations.
Do I need to comply with both NIS2 and CER?
Not automatically. NIS2 applies if you are an essential or important entity under national NIS2 rules. CER Chapter III resilience duties apply if your Member State identifies and notifies you as a critical entity. Many industrial sites will face both, but some CER sectors have limited or no Chapter III obligations unless national law says otherwise. Always check your national transposition and any notification letter you receive.
When do CER resilience obligations start?
Member States had to identify critical entities by 17 July 2026 and notify them within one month of identification. For those entities, Chapter III typically applies from 10 months after that notification. Critical entities must also carry out a risk assessment within nine months of notification. Exact dates follow your national notification.
Do CER rules apply to contractors and other external workers?
Yes. CER Article 13 requires critical entities to manage people security for critical roles and to take into account staff of external service providers, not only their own employees.
How does NIS2 affect physical site access?
NIS2 Article 21 requires an all-hazards approach that protects network and information systems and the physical environment of those systems. It also requires supply-chain security and human-resources security / access-control policies. If an external worker can reach OT or other sensitive areas, that access is part of the risk surface NIS2 expects you to manage.
What does integrated site resilience look like in practice?
Verify companies and people before arrival, limit access by zone and time, connect cameras and gate systems so live conditions can block or revoke clearance, and keep one audit trail of who was allowed in, what was checked, and when access stopped.
Where can I read the official NIS2 and CER texts?
NIS2 is Directive (EU) 2022/2555 on EUR-Lex. CER is Directive (EU) 2022/2557 on EUR-Lex. The European Commission has also published non-binding guidelines on CER Article 13 resilience measures. Always check how your country turned these rules into national law.
