customer asks about the physical security of our server room

Physical server room falls under access policy, not under continuity

The question about physical security of the server room is part of access control: who is allowed to enter, how is that logged, and how is management of company assets arranged. Customers usually ask this separately from their question about backups and emergency provisions, but in most files both fall under the same policy document. Typical sub-questions: badge or key management, camera monitoring, climate control, fire suppression, and whether the room is managed in-house or located with a data centre service provider.

If the server room is located with an external data centre service provider, the answer is often not "yes, we arrange this" but "our service provider arranges this, and we have verified it" — that affects the requirements the organization sets for its own suppliers. If the chain file does not have supporting evidence for this — an ISO 27001 certificate from the service provider, a SOC 2 report, or an inspection report of its own — then "no" or "partially" is the honest answer, even if the physical security is actually in order. Without a source, no "yes" is proposed here. If there is no separate physical security policy but the subject is mentioned in the general access policy, that is often a sufficient basis for a clarification with the answer instead of a bare "no".

Traceable to Article 21(2) NIS2 and Annex A.7 of ISO 27001

Physical and environmental security is one of the ten measures under Article 21(2) of the NIS2 Directive, and appears as its own chapter (A.7, "Physical and environmental security controls") in Annex A of ISO/IEC 27001. Companies that are already demonstrably ISO 27001-certified can often submit that certificate directly as supporting evidence instead of documenting the physical measures separately. For companies that themselves fall under the Cybersecurity Act as soon as it comes into force on 15 August 2026, there is a future obligation of their own; until that date, this is for most suppliers still purely a question from their customer, not their own legal obligation.