how do I fill in the question about physical security of our data center

Physical security falls under the ten measures

Physical security of servers and data centres falls under Article 21(2) of NIS2, which lists the ten categories of measures that an entity must take. The directive itself does not name "physical security" as a separate point, but classifies it under security of information systems and business assets — the same category that also access control and asset management falls under. If the questionnaire specifically asks about access control to the building, camera security, or climate and fire protection of the server room, you are actually answering the same question as logical access security, only the physical variant of it.

If you have your own server room, the answer is often concrete to substantiate: badge or key systems, visitor registration, cameras, and a maintenance contract for climate control are common supporting documents. If your infrastructure runs at a cloud provider or co-location partner, the question shifts: then it is not about your physical security, but about that of your provider, and that belongs to the security requirements you set for your own suppliers. In that case, a common answer is a reference to the provider's certificate or attestation (often an ISO 27001 declaration or a SOC 2 report), not your own description of a building you do not manage. If you do not have that supporting document ready, then "no, not yet available" with an explanation that it is being obtained from the provider is factually correct — better than a guess.

Where that appears in Annex A of ISO 27001

ISO/IEC 27001 works out physical security more concretely than NIS2: Annex A contains a separate category of control measures for the physical environment, with topics such as access zones, protection against physical threats and protection of equipment. Undertakings that already ISO 27001-certified are in line with that scheme can often refer directly to the statement of applicability for this question, in which these measures are already detailed. For Dutch entities that will fall under the Cybersecurity Act, this category is one of the ten on which supervision is possible once that law — the transposition of NIS2 — enters into force on 15 August 2026.