NIS2, CER, and visitor registration - an overlooked responsibility

The EU's NIS2 Directive and CER Directive impose significantly stricter requirements on companies' security, documentation, and resilience.

What are CER and NIS2, and why are they relevant to physical access? 

NIS2 is not just about IT and networks. The directive focuses on governance, risk management, control, and traceability across the entire organization—including control of who has physical access to the company's locations, systems, and critical assets.

The CER Directive focuses on physical preparedness and protection of critical infrastructure such as buildings and facilities. Here, the requirement is that companies must be able to prevent, withstand, and respond to physical and hybrid threats—and document their efforts.

The directives cover far more sectors and companies than before and require, among other things, that organizations:

• Works systematically with risk assessment and risk management.
• Provides documentation of implemented security measures.
• Controls third-party and supplier access.
• Enables prompt and documented response to incidents.
• Establishes contingency and continuity plans.
• Implements measures against physical threats.

In practice, this applies to both digital and physical security – and the interaction between them.

Why does digital visitor registration play a key role?

Visitors, suppliers, and external consultants are an inherent part of daily operations – yet they also contribute to the company's overall risk landscape. For compliance with both CER and NIS2, it is imperative to maintain documented control over who has access, when, and under what conditions. 

Although "visitor registration" is not explicitly mentioned in the NIS2 and CER Directives, access and visitor logging is, in practice, a prerequisite for complying with the requirements for traceability, control, and incident management.

Digital visitor registration solutions contribute to, among other things: 

• Traceability and documentation
  In the event of security incidents, it is crucial to be able to quickly account for who had access to which areas and when. A digital visitor log provides a precise and searchable overview, supporting both internal investigations and regulatory requirements.
• Enhanced Physical Access Control 
  When visitor registration is integrated with access control, it ensures that visitors are granted access solely to designated areas. This mitigates the risk of unauthorized access to critical systems and infrastructure. 
• Effective crisis and incident management
  In the event of an evacuation, operational shutdown, or security incident, it is crucial to know who is present on the premises. An up-to-date digital overview significantly increases security, safety and responsiveness.
• Third-party risk management
  Both NIS2 and CER require control of external parties. Digital registration of visitors, suppliers, and contractors documents their visits and strengthens control of the company's extended risk exposure.

Should an organization be unable to document who has accessed critical areas – specifying when and why – visitor registration will be considered a significant deficiency in its security measures, particularly within the context of NIS2 and CER compliance.

Acceptance of policies – not just registration 

A modern visitor registration system is not just about names and times. It is also about responsibility.

A digital solution enables visitors toactively accept access conditions, security policies, and internal guidelinesbefore or upon arrival. This strengthens both compliance and documentation.

For companies covered by CER and NIS2, this is particularly relevant because: 

• Responsibilities and expected behavior must be clearly communicated.
• Security policies must be documented.
• Compliance with internal regulations must be demonstrable.

At the same time, personal data must be handled in accordance with applicable data protection regulations, GDPR. 

A practical step towards CER and NIS2 compliance 

For companies classified as critical infrastructure and thus subject to CER and NIS2, visitor registration is not merely an administrative detail. It is a concrete, demonstrable, and operational security measure that supports: 

• Risk management.
• Traceability.
• Compliance.
• Preparedness and evacuation.
• Physical and digital security. 

When visitor registration is digitized, structured, and seamlessly integrated into an organization's comprehensive security architecture, it transforms into an indispensable element for ensuring CER and NIS2 compliance.

Solutions such as BmyGuest Visitor Management makes it possible to combine efficient visitor registration, digital acceptance of policies, and documentable access control in a single platform – thereby taking a concrete step toward a more robust and compliant organization.

Read more about BmyGuest Visitor Management here