No. NIS2 compliance always applies to the operator as a whole and includes areas such as risk management, incident reporting, registration requirements, and governance. Access control addresses one clearly defined part of this framework: physical protection measures and their documentation.

This is exactly where deister can support you. Electronic access control, centrally managed permissions, and traceable access logs help secure and document physical access systematically. Commander Connect can be used to centrally manage and evaluate doors, keys, and other deister systems.

Under the German BSIG, relevant measures include concepts and processes for access control and the management of ICT systems, products, and processes, as well as the use of multi-factor or continuous authentication solutions.

In practice, this can mean assigning access rights according to person, area, and time period, providing additional protection for particularly sensitive areas, and documenting access events transparently. deister combines electronic readers, locking systems, and centralized permission management into an end-to-end access concept.

That depends on who is allowed to enter the server room. If cleaning staff, facility management teams, external contractors, or multiple user groups have access, the server room door alone may no longer provide a sufficient security boundary.

With the deister SRL 1, access to individual server racks can also be electronically controlled and logged.

The Cyber Resilience Act establishes mandatory cybersecurity requirements for products with digital elements. The CRA becomes fully applicable on 11 December 2027, while reporting obligations for actively exploited vulnerabilities and severe security incidents apply from 11 September 2026. Manufacturers are required, among other things, to address vulnerabilities during the support period and consider cybersecurity throughout the product lifecycle.

For operators, this means it is worth looking closely at the manufacturer when making purchasing decisions: How are vulnerabilities handled? How are security updates provided? And how long is the product supported? deister develops its connected systems with these requirements and long-term updateability in mind.

Important: CRA reporting obligations may also apply to certain products that were placed on the EU market before 11 December 2027. Other CRA obligations for previously marketed products generally depend on the applicable transitional provisions and whether the product is substantially modified.

In many cases, a complete replacement is not necessary.

deister solutions can be integrated into existing infrastructure step by step. Electronic cylinders, door handles, and readers can be deployed specifically where the risk assessment identifies a higher need for protection. Existing areas can therefore be modernized gradually instead of replacing the entire system at once.

Access and key-issue data may constitute personal data. Purpose limitation, retention periods, the level of reporting detail and, where applicable, involvement of the works council should therefore be clarified before the system is introduced.

Commander Connect supports the technical administration and evaluation of this information: permissions, access events, keys, and other resources can be managed centrally, while reports can be configured individually and provided automatically.

However, deciding which data may be stored, evaluated, and retained – and for how long – remains an organizational and legal responsibility of the operator.

Not every door and not every area requires the same technology. That is why deister reviews your existing infrastructure together with you – from the perimeter and buildings to sensitive interior areas, server racks, keys, and equipment.

This makes it possible to identify where adequate measures are already in place and where access control, traceability, or permission management could still be improved.