13.2 Protection against physical and environmental threats

Requirement

For the purpose of Article 21(2)(e) of Directive (EU) 2022/2555, the relevant entities shall prevent or reduce the consequences of events originating from physical and environmental threats, such as natural disasters and other intentional or unintentional threats, based on the results of the risk assessment carried out pursuant to point 2.1.

Guidance

• Consider risks associated with current and forecasted physical and environmental threats to the network and information systems, where relevant (108).
  • Include in the assessment the (physical) locations of the entity’s facilities.
• Based on the results of the risk assessment determine the assets that need to be protected from physical and environmental threats.

Examples of evidence

• Risk assessment report that includes:
  • identification and evaluation of physical locations, such as data centres, offices and server rooms,
  • analysis of potential physical and environmental threats and
  • mapping of critical assets to physical locations.

Requirement

For that purpose, the relevant entities shall, where appropriate:

(a) design and implement protection measures against physical and environmental threats;

(b) determine minimum and maximum control thresholds for physical and environmental threats;

(c) monitor environmental parameters and report to the competent internal or external personnel events outside the minimum and maximum control thresholds referred to in point (b).

Guidance

• Implement measures against physical and environmental threats. Parameters to consider are (indicative, non-exhaustive list):
  • purpose and scope;
  • network and information systems in scope;
  • description of facilities;
  • roles and responsibilities;
  • management commitment;
  • coordination among organisational units;
  • compliance with national and EU law, including personal data protection.
• Consider potential physical and environmental threats relevant to the context, location and operational environment. The following list offers examples (indicative and non-exhaustive) to support risk-based planning:
  • fire, flood or natural events (e.g. earthquakes, storms),
  • public disturbances or unauthorized access, theft or vandalism,
  • hazardous material incidents (e.g. chemical spills),
  • long-term environmental changes (e.g. climate trends, air quality).
• Consider measures against physical and environmental threats such as (indicative, non-exhaustive list):
  • physical access control measures (e.g. IDs, badges, logs; visitor management system and physical barriers);
  • surveillance systems (e.g. CCTV, entry points, exits, locking mechanisms and security personnel);
  • climate control (e.g. temperature and humidity controls and HVAC systems);
  • fire prevention and response measures (e.g. fire alarms, smoke detectors, sprinkler systems and fire extinguishers);
• Consider enhanced (maximum) measures to be activated during heightened threat levels or specific scenarios. Examples of such measures include (indicative, non-exhaustive list):
  • Increased security personnel, advanced biometric access controls and lockdown procedures.
  • Enhanced monitoring systems, redundant power supplies and advanced environmental sensors.

Examples of evidence

• Detailed documentation showing the design and implementation of measures against physical and environmental threats.
• Reports outlining the defined minimum and maximum control thresholds for various threats.
• Logs from environmental monitoring systems showing continuous tracking of parameters, such as temperature, humidity and security breaches.
• Records of incidents where parameters fell outside the defined thresholds, including the actions taken and notifications sent to relevant personnel.

Requirement

The relevant entities shall test, review and, where appropriate, update the protection measures against physical and environmental threats on a regular basis or following significant incidents or significant changes to operations or risks.

Guidance

• Schedule and perform regular tests, such as quarterly fire drills and annual assessments of physical security measures.
  • Conduct both announced and unannounced tests

Examples of evidence

• Detailed reports of the tests conducted, including objectives, procedures, results and any issues identified.
• Minutes from review meetings detailing discussions, findings and decisions regarding protection measures.

Tips: guidance

• Consider creating a topic-specific policy for protection against physical and environmental threats.
• Deploy periodic simulations and awareness raising activities to assess the readiness of personnel and the adequacy of the procedures
• Consider implementing physically secure storage facilities for high-criticality assets of.

Tips: examples of evidence

• Documented physical and environmental security policy, including a description of facilities and network and information systems in scope.
• Results of periodic simulations and awareness raising activities.