Compliance starts at the door
Information security standards also impose requirements on physical access. Who is allowed to enter which room, when, and can this be verified afterwards? With CyberLock and CyberAudit-Web, you have a conclusive answer to this.
Physical access is part of information security
A server room, medicine cabinet, meter cupboard, or pump building is subject to the same standards as the network behind it. In practice, physical access is often the least well-documented. Mechanical keys can be copied, key lists are stored in Excel, and no one knows who opened a door at three o'clock last night.
Since August 15, 2026, the Cybersecurity Act (the Dutch implementation of NIS2) and the Critical Entities Resilience Act (the implementation of the CER Directive) have been in effect. The former concerns digital resilience, the latter physical and organizational resilience, including access to premises and buildings. The board bears ultimate responsibility. BIO2 (government) and NEN 7510:2024 (healthcare) have also been updated and now follow the structure of ISO 27001:2022. All these frameworks require the same: secure zones, access only for authorized persons, event logging, and periodic verification of access rights.
You must be able to provide proof.
Sellox supplies four components in one system for this purpose.
Rights in the key
Which cylinders, which days, which time window, and how long the key remains valid without an update. A key that has not been renewed no longer works. In the event of loss or termination of employment, you revoke the rights via the software.
Registration in key and cylinder
Opened, refused, out of schedule, expired. The cylinder stores up to 6,500 events, the key up to 12,000. You can always see which key was used where, even without power or network access.
Report for the audit
CyberAudit-Web Enterprise collects everything in a single audit trail with date, time, key, person, and cylinder. Reports are ready per person, per door, or per period. On-premise or hosted by Sellox.
Periodic check
Immediately SX HealthCheck Sellox checks your facility: keys without an owner, departed employees with access rights, deviating diagrams, cylinders that do not report, and the versions of software and firmware.
What the standards require of keys and doors
Choose a box. This is not legal advice.
ISO 27001:2022
- For whom
- Organizations with ISMS certification. Also the basis of BIO2 and NEN 7510.
- What it asks
- Secured zones with access control (7.1–7.3), monitoring of physical security (7.4), granting, modifying and revoking access rights according to policy (5.15–5.18), event logging (8.15).
- How Sellox implements this
- Permissions per key and per zone, keys that expire automatically, the audit trail as a log source, and reports for permission control.
NIS2 / Cybersecurity Act
- For whom
- Essential and important entities in 18 sectors, including energy, drinking water, healthcare, transport, digital infrastructure, and government. In force since 15 August 2026.
- What it asks
- Duty of care with appropriate measures, including a policy for access control and security of personnel and assets; reporting obligation for significant incidents; managerial responsibility.
- How Sellox implements this
- Access to technical rooms and field objects is restricted to authorized persons, without cabling, with subsequent registration. In the event of an incident, it is immediately visible which key was used where.
Critical Entities Resilience Act (CER)
- For whom
- Approximately 500 organizations designated as critical entities by their ministry, in sectors such as energy, drinking water and wastewater, flood control and management, transport, healthcare, digital infrastructure, and government. In force since August 15, 2026, alongside the Cybersecurity Act: the Cbw concerns digital resilience, while the Wwke concerns physical and organizational resilience.
- What it asks
- Within 9 months of designation, a risk assessment and within 10 months appropriate technical, organisational and physical measures, including protection of sites and buildings with access control, management of access rights and background checks for sensitive positions; reporting of disruptive incidents within 24 hours.
- How Sellox implements this
- Access control for objects without power or network (pumping stations, stations, locks, hydraulic structures), rights per person, zone, and time window, revocation upon departure, and an audit trail showing what happened per key and per cylinder, even after an incident.
BIO2 (government)
- For whom
- National government, provinces, municipalities, and water boards. BIO2 v1.3 was adopted on March 5, 2026, and replaces the old BIO.
- What it asks
- The same structure as ISO 27001:2022, supplemented with government measures for secure zones, access to trusted zones, and warnings in the event of concrete risks.
- How Sellox implements this
- Zoning by cylinder group, keys that only work where and when permitted, and an audit trail for ENSIA reporting.
CSIR 3.0 (objects with process automation)
- For whom
- Owners and managers of bridges, locks, pumping stations, treatment plants, and other objects with process automation. The guideline originates from Rijkswaterstaat and the water boards, but municipalities and other managers also include it in their contracts, and thus it applies to their contractors and suppliers. The Cybersecurity Implementation Guideline for Objects supplements the BIO for industrial automation, using IEC 62443 as a source.
- What it asks
- Physical access to IA rooms, grounds, and buildings for authorized persons only (Chapter 2.1); an up-to-date locking plan and active management of keys and safes (FTG9, FTG29); issuance and revocation of access credentials upon change of function or departure (LP10); rights based on role and need-to-have (LP2); review access rights at least every six months (LP4).
- How Sellox implements this
- An electronic key plan per property, rights per role and per zone, keys that expire if not updated, and reports per person and per property for the semi-annual rights check.
NEN 7510:2024 (healthcare)
- For whom
- Hospitals, mental healthcare, elderly care, home care, pharmacies and their suppliers.
- What it asks
- Physical access to areas containing patient information and medical equipment restricted to authorized personnel, with registration and monitoring; management of keys and access means as part of the ISMS.
- How Sellox implements this
- Medicine cabinets, archive rooms, server rooms, and technical rooms with one key per employee, access rights per service or department, and registration per opening.
AVG / GDPR
- For whom
- Every organization. An audit trail containing names constitutes the processing of personal data.
- What it asks
- A legal basis and purpose for the registration, a retention period, access to the data limited to those who need it, and inspection by the data subject.
- How Sellox implements this
- The audit trail is located on your own server or hosted by Sellox in the Netherlands, retention periods are configurable, and access to CyberAudit-Web is managed per user and role.
EU GMP Annex 11 (pharmacy)
- For whom
- Manufacturers and distributors under GMP.
- What it asks
- Access to GMP-relevant areas and equipment restricted to authorized persons, with an audit trail.
- How Sellox implements this
- Access to cleanrooms, cold storage rooms, and sample cabinets is recorded per key and per room.
ABRO 2026 (National Government and Police)
- For whom
- Companies working on a special assignment from the central government or the police, an assignment that affects national security, including their subcontractors and suppliers. Applicable since January 1, 2026, and replaces the ABDO 2019, which applied only to Defence. Not a law, but a contractual requirement; the National Bureau for Industrial Safety (NBIV) assesses and issues the ABRO declaration.
- What it asks
- The Client determines the security level and the NBIV chapters applicable per assignment: governance and organization, personnel reliability, physical security, cybersecurity, and cloud. Physical: layered security tailored to the level, access only for screened persons based on need-to-know, visitor registration, and registration of access to protected interests. From TBB 3 onwards, remote management is not permitted.
- How Sellox implements this
- Sellox is familiar with these requirements from its own Defense contracts. Compartmentalization by zone, validation without a wireless connection and on-site management where required, keys with a short validity period, and an audit trail per key and per cylinder.
Three questions behind every right of access
Regardless of the applicable framework, an auditor always arrives at the same three questions. This is how you translate them into keys and doors.
Information, and the spaces where it is located, are accessible only to those who need it for their task. A server room, archive, or meter cupboard is not a general area.
Entitlements per zone instead of per building. A key only opens the cylinders associated with the function.
Access restricted to the place and time of the work: this location, this service, this time window. Those who do not need to be there will not enter.
Time windows per key and a validity that expires if the key is not updated. A breakdown service is granted rights for one service.
For certain areas, a valid designation or certification applies, such as for work on high-voltage installations or securing an installation. A right of access is not a work permit, but the two should complement each other.
Met dynamische toegang (de module Dynamic Tags) koppelt u een recht aan een voorwaarde. Verloopt de certificering of eindigt het dienstverband, dan vervalt het recht vanzelf. Meer over dynamische toegang
Seven questions from an auditor
Who currently has access to your server room, medicine cabinet, or technical room?
Report access rights per cylinder or zone, directly from CyberAudit-Web.
Who opened a specific door in the past 30 days, and when?
Audit trail per cylinder: date, time, key, and person.
What happens to the access of an employee leaving the company today?
Revoke rights in the software. The key will no longer work anywhere afterwards.
How many keys are in circulation whose whereabouts you do not know?
Key overview with owner, status, and last contact time.
Can a key be copied without you noticing?
CyberKeys are electronic and cannot be copied.
When were all access rights last checked, and was this recorded?
Rights report with date, as evidence for the periodic audit.
Is access also registered at locations without power or network?
Yes. Key and cylinder register themselves, without wiring.
With CAW, it is covered by a report.
Demonstrably in order in four steps
Inventory
Mapping zones, keys, and framework of standards, translated into a key plan.
Furnishing
Cable-free cylinder replacement, person- and zone-based rights, CyberAudit-Web Enterprise on-premise or hosted.
Reporting
Audit trail and reports tailored to your auditor's questions.
Maintenance
Periodic SX HealthCheck, also after reorganizations and personnel changes.