Article 21(2) of NIS2 requires cybersecurity risk-management measures to be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems. Recital 79 gives examples: theft, fire, flood, telecommunication or power failures, and unauthorised physical access. Physical and environmental security is part of NIS2, not an optional extra.
This guide covers what the all-hazards approach means, the hazards the recitals name, where physical security sits in the ten measures, the detailed rules for digital providers, the link with the CER Directive, a proportionate SME baseline and a checklist.
The mapping is practice, not an official table.
| Hazard | NIS2 hook | Typical control |
|---|---|---|
| Fire | Recital 79; Art. 21(2)(c) | Detection in equipment rooms, backups in another location |
| Flood or water leak | Recital 79; Art. 21(2)(c) | Equipment off the floor, leak sensors, tested restore |
| Power failure | Recital 79; Art. 21(2)(c); Reg. 2024/2690 s. 13.1 | UPS with clean shutdown, generator where the service needs it |
| Telecom or internet failure | Recital 79; Art. 21(2)(c) and (j) | Second connection, emergency channel off the main network |
| Cooling failure | Reg. 2024/2690 recital 29, s. 13.2 | Temperature and humidity alerts, redundant cooling |
| Theft of equipment | Recital 79; Art. 21(2)(h) and (i) | Asset inventory, disk encryption, remote wipe |
| Unauthorised access, tampering, sabotage | Recital 79; Art. 21(2)(i); Reg. 2024/2690 s. 13.3 | Locked rooms, key and badge register, leaver process |
| Provider site failure | Art. 21(2)(c) and (d) | Provider evidence, tested plan for losing a site or region |
What is the NIS2 all-hazards approach?
Article 21(2) opens: “The measures referred to in paragraph 1 shall be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents, and shall include at least the following”. The ten measures follow.
- It applies to every essential and important entity, not only to data centres or critical infrastructure.
- It is not an eleventh measure. It is the basis for all ten.
- The object is the network and information systems. Recital 79 frames the hazards by what they could compromise: “the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data” or of the services those systems provide.
In practice, that sets the boundary. A leaking roof over the canteen is a facilities problem. A leaking roof over the comms room is a NIS2 problem.
A flood in a server room destroys hardware faster than ransomware, and a power cut stops a service as surely as a denial-of-service attack.
Which hazards does NIS2 mean?
Recital 79 lists events “such as theft, fire, flood, telecommunication or power failures, or unauthorised physical access and damage to, and interference with, an essential or important entity’s information and information processing facilities”. The measures should protect systems “from system failures, human error, malicious acts or natural phenomena, in line with European and international standards, such as those included in the ISO/IEC 27000 series”. The recital also brings in human resources security and access control policies, and asks for consistency with the CER Directive.
For the digital providers covered by Implementing Regulation (EU) 2024/2690, its recital 28 adds “earthquakes, explosions, sabotage, insider threat, civil unrest, toxic waste, and environmental emissions”.
These are examples, not a closed list, and recitals explain the article rather than bind on their own. Your risk analysis decides which apply.
Where does physical security sit in the ten Article 21 measures?
No point of Article 21(2) is headed “physical security”. It runs through five of them:
- (a) Risk analysis: physical hazards go in the same register as cyber threats.
- (c) Business continuity, backup management, disaster recovery and crisis management: they have to survive a fire, a flood or a long power cut.
- (d) Supply chain security: a colocation site or cloud region is your physical environment, run by someone else.
- (i) Human resources security, access control and asset management: physical access to rooms, and knowing where assets are.
- (j) “Secured emergency communication systems within the entity, where appropriate”: a way to coordinate when the office network is down.
All ten are in the NIS2 Article 21 measures explained.
What does Implementing Regulation 2024/2690 require?
For the digital providers named in Article 21(5), from DNS and cloud to data centres, managed service providers, online platforms and trust service providers, Article 21 is spelled out in Implementing Regulation (EU) 2024/2690. Section 13 of its Annex, “Environmental and physical security”, has three parts:
- 13.1 Supporting utilities. Recital 28: preventing loss or interruption “due to the failure and disruption of supporting utilities” should contribute to business continuity.
- 13.2 Protection against physical and environmental threats. Recital 29: design protection measures, set minimum and maximum control thresholds and monitor environmental parameters.
- 13.3 Perimeter and physical access control.
Recital 29 lists things providers “should consider”: early flood detection, a separate fire compartment for the data centre, fire-resistant materials, temperature and humidity sensors, automated fire alarm notification to the local fire department, and overvoltage protection with emergency power. Fire drills and inspections are a “should”; redundant air conditioning a “could consider”.
The binding text is the Annex, and ENISA’s technical implementation guidance of June 2025 adds examples of evidence. Provider detail is in NIS2 for cloud, data centres and digital infrastructure. If you are not one of these providers, the Regulation does not bind you, but it is a sensible benchmark.
How does NIS2 relate to the CER Directive?
The CER Directive, (EU) 2022/2557, covers the resilience of entities that Member States identify as critical, including against non-cyber risks, in eleven sectors from energy and transport to digital infrastructure and food. Member States had to identify their critical entities by 17 July 2026. NIS2 recital 30 cites “the interlinkages between cybersecurity and the physical security of entities”.
- A critical entity under CER is an essential entity under NIS2, whatever its size (NIS2 Articles 2(3) and 3(1)).
- CER does not apply to matters covered by NIS2, and the two must be implemented in a coordinated manner (CER Article 1(2)).
- Critical entities assess their risks within nine months of notification, then at least every four years (CER Article 12). They ensure physical protection of premises, “duly considering, for example, fencing, barriers, perimeter monitoring tools and routines, detection equipment and access controls” (Article 13(1)(b)).
- In banking, financial market infrastructure and digital infrastructure, Article 11 and Chapters III, IV and VI of CER, which include those resilience duties, do not apply (Article 8). For digital infrastructure, CER recital 20 says NIS2 already “applies an all-hazards approach that includes the resilience of network and information systems, as well as the physical components and environment of those systems”. For finance, see NIS2, DORA and the financial sector.
- NIS2 and CER authorities exchange information regularly, and NIS2 authorities inform CER authorities when supervising a critical entity (NIS2 Articles 13(5) and 32(9)).
In practice, a critical entity in energy, transport, health or water answers to both. A sensible approach is one risk assessment mapped to both regimes, not two registers that disagree about the same substation. The sector view is in NIS2 for the energy sector.
What does proportionate physical security look like for an SME?
Article 21(1) sets proportionality by the entity’s exposure to risks, its size, and the likelihood and severity of incidents, including their societal and economic impact. It decides how far you go, not whether.
Most SMEs in scope run no data centre. Their physical environment is a network cabinet in an office, laptops that leave the building daily, and cloud or colocation providers. A proportionate baseline, in practice:
- Record in the asset inventory where systems physically run, including cloud regions.
- Lock the network cabinet or server room. Keep a key and badge register and recover both from leavers.
- Put a UPS on the core network and on-premises servers, sized for a clean shutdown.
- Alert a person when the temperature in an equipment room goes out of range.
- Encrypt laptop disks and enable remote wipe, so a stolen laptop is a hardware loss, not a data exposure.
- Keep backups away from the systems they protect, and test a restore.
- Give critical sites a second internet path and an emergency channel independent of the office network.
- Collect providers’ physical security evidence, such as an ISO/IEC 27001 certificate covering your site, and plan for losing that site.
You cannot stop a flood. You can make sure it does not take the service and the backups with it.
If you run ISO 27001, the physical theme of Annex A already has 14 controls, 7.1 to 7.14, sorted by the work they need in the Annex A controls grouped for real work.
A register layout:
PHYSICAL AND ENVIRONMENTAL HAZARD REGISTER (one per site)
Site or location:
Systems and services at this site:
Provider (colocation or cloud), evidence held, expiry:
Hazard Likelihood Impact Control in place Owner
Fire L/M/H L/M/H
Water: flood or leak
Power loss over 1 hour
Internet or telecom loss
Cooling failure
Theft of equipment
Unauthorised access or tampering
Loss of the whole site
Last restore test from outside this site (date, result):
Accepted risks and who accepted them:
Next review date:What the all-hazards approach leaves open, and how to close it
NIS2 says what to protect and against what. It does not say how much is enough, or what counts as evidence. The gap shows in the register: flood rated low for a basement comms room, and a UPS nobody has tested since it was installed.
Physical evidence also lives outside the IT stack: badge logs, UPS self-tests, temperature alerts, the key register, provider certificates. It gets checked, if at all, before an audit.
Closing the gap means treating physical controls like the others. Pull what can be pulled automatically: encryption coverage, backup and restore results, environmental and UPS alerts. Put the rest on a schedule with an owner, and have a person review the exceptions. That is how the CloudSoul platform works: automated, with human-in-the-loop expertise. A security audit against Article 21 shows where you stand, and the wider programme is on the NIS2 compliance page.
NIS2 all-hazards checklist
- Add physical and environmental hazards to the risk register, per site.
- Record where every system physically runs, including cloud regions.
- Lock equipment rooms and cabinets, and keep the key and badge register current.
- Keep backups away from the systems they protect, and test a restore.
- Put a UPS and temperature alerts on equipment rooms.
- Collect physical security evidence from providers, and check its scope.
- If you are a critical entity under CER, run one risk assessment for both regimes.
Sources
- Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 13, 21 and 32 and recitals 30 and 79, EUR-Lex.
- Commission Implementing Regulation (EU) 2024/2690, recitals 28 and 29 and Annex section 13, EUR-Lex.
- Directive (EU) 2022/2557 on the resilience of critical entities (CER), Articles 1, 6, 8, 12 and 13 and recital 20, EUR-Lex.
- European Commission, Critical infrastructure resilience, Migration and Home Affairs.
- ENISA, NIS2 Technical Implementation Guidance, June 2025, ENISA.
Frequently asked questions
What is the all-hazards approach in NIS2?
Article 21(2) of NIS2 requires cybersecurity risk-management measures to be based on an all-hazards approach that aims to protect network and information systems and the physical environment of those systems from incidents. Physical and environmental events such as theft, fire, flood and power or telecommunication failures are in scope, not only cyberattacks.
Does NIS2 require physical security?
Yes, as part of Article 21. Recital 79 says the measures should also address the physical and environmental security of network and information systems, including unauthorised physical access, in line with standards such as the ISO/IEC 27000 series. NIS2 names no specific physical controls: your risk analysis and proportionality decide how far you go.
What does Implementing Regulation 2024/2690 say about physical security?
For cloud, data centre, DNS, managed service and the other listed digital providers, section 13 of its Annex covers environmental and physical security in three parts: supporting utilities, protection against physical and environmental threats, and perimeter and physical access control.
What is the difference between NIS2 and the CER Directive?
NIS2 covers the cybersecurity of network and information systems, including their physical environment. The CER Directive (EU) 2022/2557 covers the resilience of entities that Member States identify as critical, including against non-cyber risks. A critical entity under CER is an essential entity under NIS2, whatever its size.
Does NIS2 require a generator or a second data centre?
No. NIS2 names no specific physical control. Article 21 requires appropriate and proportionate measures based on exposure, size, likelihood and severity. In practice, for most SMEs, a UPS sized for a clean shutdown, backups kept away from the systems they protect and a tested restore are the proportionate baseline.
