questionnaire asks about physical security of server room or data center

Physical security falls under access policy, not under a separate theme

The question about physical security of the server room or data center is usually an elaboration of a broader point: access policy, including management of business assetsWhoever can physically access the equipment can also gain logical access — which is why this is usually covered in the same section as access management, not as a separate topic. Answer based on what actually exists: badge or key system, camera surveillance, who has a key or card, and whether that is logged. If the server room is with an external data center provider, the answer is often a reference to their measures, not something the organization itself manages.

If hosting is outsourced, the question is closely related to supply chain management: the requirements the organization sets for its own suppliers is then the starting point, with the data center certificate or the supplier's SOC 2 report as evidence, not an in-house description of locks and cameras. If the organization has no server room of its own and everything is in the cloud, then "not applicable, services run at [supplier], see their certification" is a complete answer — provided that is actually the case. If a formal document is missing but there is a factual measure (for example: server room in a locked cabinet in a building with access control), that is also a valid answer — just without a certificate attached.

Where this comes from: Annex A and Article 21 paragraph 2

ISO/IEC 27001 Annex A lists physical and environmental security as a separate control measure, distinct from logical access control — which is why an auditor asks about it separately, even though at Supplia it falls under the same supply chain file. Article 21 paragraph 2 of the NIS2 Directive does not mention physical security as a separate point among the ten measures, but access control policy and protection of business assets are covered — physical access to the server room is a practical implementation of that. Under the Cybersecurity Act, the Dutch implementation that enters into force on 15 August 2026, that does not change fundamentally: the ten measures return, physical security remains part of access policy rather than a standalone requirement.