13.3: Perimeter and physical access control

1. For the purpose of Article 21(2)(i) of Directive (EU) 2022/2555, the relevant entities shall prevent and monitor unauthorised physical access, damage and interference to their network and information systems.

2. For that purpose, the relevant entities shall:

1. on the basis of the risk assessment carried out pursuant to point 2.1, lay down and use security perimeters to protect areas where network and information systems and other associated assets are located;
2. protect the areas referred to in point (a) by appropriate entry controls and access points;
3. design and implement physical security for offices, rooms and facilities,
4. continuously monitor their premises for unauthorised physical access.

3. The relevant entities shall test, review and, where appropriate, update the physical access control measures on a regular basis or following significant incidents or significant changes to operations or risks.