IR 2024/2690 13 physical and environmental security

What NIS2 physical and environmental security requires in practice

Section 13 of the Annex to Implementing Regulation (EU) 2024/2690 covers three areas: supporting utilities (13.1), protection against physical and environmental threats with minimum and maximum control thresholds (13.2), and perimeter and physical access control (13.3). These points are tied to Article 21(2)(c), (e) and (i) of NIS2. If your facilities, power, cooling or access points support in-scope services, you must defend them, prove that the defenses work, and keep that proof current. The risks are concrete: a power or cooling failure that takes systems offline, environmental drift such as temperature or humidity creeping out of range without anyone noticing, and unauthorized entry to server rooms or network closets. This area is often hard for three reasons. Many facilities are shared with a landlord or a colocation provider, so your control over power feeds, cooling and building access is partial and depends on contract terms you may not have reviewed for this purpose. Environmental thresholds are rarely written down, which leaves the monitoring team guessing what counts as an event. Access lists also drift: staff change roles, contractors finish projects, and badges are not always revoked. Start by asking your facilities provider and colocation operator, in writing, which utility and access controls they operate and which they leave to you.

Point 13 also requires that physical and environmental measures be tested, reviewed and updated regularly, and again after a significant incident or a significant change such as a new cooling unit, a changed power supply or a move of equipment. Treat each of these triggers as a scheduled task with an owner and a record. Decide now who sets the minimum and maximum thresholds, based on your risk assessment, and who receives alerts when readings fall outside them. Confirm with your monitoring team that alert routing reaches a person who can act outside office hours. The evidence an assessor will ask for includes a physical security policy, procedures for granting and revoking physical access, test schedules and results, and a current list of people with authorized physical access, as ENISA's June 2025 guidance describes.

Which facilities, utilities and third parties fall under point 13

Point 13 applies to every place where your systems physically run and every party that can reach them. The decisions below determine which premises, utility lines and third parties enter the risk assessment, and therefore which thresholds, monitoring and access evidence you must produce.

Owned data centers

If you operate your own data center, you control the full set of point 13 measures: the security perimeter, entry controls, power, cooling and environmental thresholds. Each of these must be defined from your risk assessment, monitored, and tested on a regular basis. Your evidence set is the largest here, since the policy, access lists, threshold records and test results all originate with your team. Confirm that your risk assessment names this site as a distinct security perimeter.

Colocation and cloud regions

When systems sit in a colocation facility or a cloud region, the provider operates the building, but you still own the risk for your systems. Point 13 does not transfer to the provider by default. Obtain the provider's physical security documentation, access procedures and environmental monitoring commitments, then record how they map to your own thresholds and to the events you must act on. Ask for evidence you can present to a supervisor, not only marketing summaries.

Server rooms in offices

Small server rooms and comms cabinets inside office buildings are the most common gap in scoping. They often share keys, cooling and power with the rest of the building and fall outside the data center register. Include every such room in the risk assessment with its own perimeter, access list and temperature and humidity monitoring. Illustrative example: a room that holds an authentication server and is cooled only by an office air conditioner still needs minimum and maximum thresholds.

Network closets and edge sites

Network closets, branch cabinets and edge sites hold switches, firewalls and routers that carry traffic for the whole organization. They are easy to overlook because they are small and unstaffed. Inventory each closet, record who holds keys or badges, and confirm that connectivity and power are monitored and that failures raise an alert. An unlocked closet on a shared floor is a finding an assessor will test.

Power, cooling and fuel supply

Utility feeds, uninterruptible power, generators, cooling units and the fuel that keeps emergency power running are in scope where they support your systems. Where appropriate, the regulation expects you to protect facilities from utility failures, consider redundant utilities and contract emergency fuel supplies. Identify which of these you own and which a utility or vendor supplies, and record the contract terms that govern supply continuity.

Telecom lines and cabling paths

Power and telecommunications lines entering a facility are a distinct scoping item, separate from the equipment inside it. Map where external fibre and copper enter each site, which conduits and risers they share with other tenants or utilities, and who can physically reach them. Confirm with your carriers how cable routes are protected and how service failures are reported to you. A single entry point shared by all circuits is a concentration risk to document.

Third parties with physical access

Landlords, facility managers, cleaners and maintenance vendors can enter protected areas without being part of your systems team. Each category needs a documented access rule, a record of who holds access, and a process for revoking it when a contract ends. Confirm that their access is logged, that escorts are used in restricted areas where your procedure requires it, and that the people list is kept current. Contractual confidentiality and background checks should be recorded alongside it.

How an assessor tests physical and environmental controls

This table compares how an assessor would test each part of Section 13 of the Annex to Implementing Regulation 2024/2690, the evidence requested and the findings that commonly appear. Read each row as a test plan: the approach shows what the assessor does, the evidence shows what to have ready, and the common findings show where preparation usually falls short. The main takeaway is that thresholds, access lists and test records must be traceable to the entity's own risk assessment, not to vendor defaults or undated documents.

Area	Test approach and evidence requested	Common findings
13.1 Supporting utilities	Document review of the utility dependency map and the risk assessment, then a site walkthrough of power, cooling and connectivity feeds. Evidence: redundancy design, emergency fuel or supply contracts, and records of power, temperature, humidity and connectivity monitoring tests.	Redundant feeds documented but never failover-tested; emergency fuel contract missing or expired; monitoring records absent for some utilities.
13.2 Protection against physical and environmental threats	Review the documented minimum and maximum thresholds and where they came from, then sample alarm and event logs to confirm out-of-range events were detected and reported. Evidence: threshold register, environmental sensor configuration, alarm history and response tickets.	Thresholds that exist only as vendor or hardware defaults with no link to the risk assessment; alarms configured but not routed to anyone; out-of-range events with no recorded response.
13.3 Perimeter and physical access control	Confirm security perimeters on the premises plan match the risk assessment, then walk the entry points. Sample access grants and revocations against tickets and approvals, and check monitoring coverage such as cameras and intrusion alerts. Evidence: perimeter map, access control policy, grant and revocation records, monitoring logs.	Access list containing former staff or contractors; access lists not matching HR or contract records; perimeter drawn on paper but a side door left unmonitored.
Testing and review of physical and environmental measures	Request the test schedule and the most recent test results for points 13.1 to 13.3, then check whether reviews followed significant incidents or significant changes such as a facility move, new cooling plant or new access system. Evidence: dated test reports, change records, review sign-off and updated procedures.	Test schedule exists but last test predates a significant change; results recorded without remediation owners; reviews not repeated after an incident.
Physical security policy and procedures	Review the policy against the access grant and revocation procedures and the environmental procedures, then confirm staff know the current version. Evidence: approved policy with version history, procedures, and training or briefing records.	Policy approved years earlier and not updated for cloud or colocation changes; procedures that name roles no longer in place.
Third-party facilities and hosting	Where a data center or colocation provider hosts systems, request the provider's evidence for utilities and access control and the entity's own review of it. Evidence: contract terms on facility controls, provider reports the entity has reviewed, and records of that review.	Entity relies on a provider certificate without reviewing scope; no contractual right to receive test results; facility controls not included in the supplier register.

How to implement point 13 step by step

This sequence turns the physical and environmental requirements of point 13 into a working set of registers, maps, perimeters, monitoring rules and test records that an assessor can trace back to the risk assessment.

Confirm the facility inventory and ownership
Start by listing every site that hosts in-scope systems, including data centers, server rooms, network closets, colocation cages, and facilities run by cloud or hosting providers. For each site, record who owns the building, who operates it, and which contracts or shared-responsibility terms govern physical controls. The organization remains accountable for its controls even where a provider runs the facility, so ownership gaps must be closed in writing. The step is done when the team holds a facility register that names each site, its operator, its contract reference and the systems it supports, and management has confirmed it.
Set thresholds per site from the risk assessment
For each facility, use the risk assessment to decide the minimum and maximum acceptable values for physical and environmental parameters such as temperature, humidity, power and connectivity. Thresholds should reflect what the hosted systems can tolerate and what the local hazards are, so a flood-prone site and a building with stable conditions may not share the same limits. Record the reasoning next to each value so an assessor can see why it was chosen. The step closes with a threshold register, approved by the owner of the risk assessment, that lists each parameter, its limits, its site and the date it was last reviewed.
Map utility dependencies and emergency supplies
Trace what each facility depends on: grid power, backup generators, uninterruptible power supplies, cooling, water where relevant, and telecommunications lines in and out of the site. Note where a single feed or single carrier creates a weak point and where redundant utilities are feasible. For emergency power, identify the contracted supply of fuel, its delivery terms, the storage on site and the expected run time as stated by the supplier, and confirm these with the operator. The output is a utility dependency map showing each feed, its redundancy status, its protection, and the contract that secures emergency supplies, reviewed with facilities staff.
Define security perimeters and entry controls
Using the risk assessment and the facility register, draw the security perimeters for each site, such as building boundary, data hall, cage or rack row, and the zones between them. For every perimeter, define the entry controls, including who may enter, how access is requested and approved, how it is granted and revoked, and how visitors and contractors are escorted. Link these controls to the physical security policy and the procedures for granting and revoking physical access. The step is complete when the team holds perimeter diagrams with an access matrix per zone and a current list of people authorized for each area.
Build monitoring and out-of-threshold reporting
Connect the threshold register and the utility map to monitoring. Sensors or building management feeds should report environmental parameters, power status and connectivity, and monitoring should cover premises for unauthorized physical access. Configure alert rules so that any reading outside the minimum or maximum limits creates an event with a named owner and an escalation path. Open-source tools such as Prometheus for metrics collection and Grafana Alerting for rules and a single alert view can hold this data if the sensors and building systems can export it, which the team should confirm for each device. The step closes when a deliberate test event produces a logged alert that reaches the named owner, and the test record is kept.
Set the test and review schedule
Agree a schedule for testing, reviewing and updating the physical and environmental measures, and write it into a signed test plan. The plan should cover power failover, generator and fuel supply checks, temperature and humidity alarms, connectivity failover, and entry control testing. It should also name triggers for an unscheduled review, such as a significant incident or a significant change to a facility, since the implementing regulation requires review in those cases too. Each test should produce a dated result that records what was tested, the outcome and the corrective actions. The step is done when the signed plan is approved by the accountable manager and the first test records exist in a shared evidence store.

Evidence that passes a physical and environmental review

An assessor testing point 13 looks for a documented decision about physical and environmental risk, then for records showing that decision is applied and kept current. The cards below follow the examples ENISA lists in its June 2025 guidance, plus the threshold and event records that show environmental monitoring works in practice.

Physical security policy

The policy sets out how the organization defines security perimeters from its risk assessment, which rooms and sites fall inside them, and who owns each control. Point 13.3.2 requires entry controls and continuous monitoring, so the policy must name both. Check that it references the current risk assessment, carries an owner and a review date, and matches what the facilities team actually does on site.

Physical access grant and revoke procedure

This procedure records who approves a physical access request, what badge or key is issued, and how access ends when a person leaves or changes role. An assessor will sample leavers and compare revocation dates with HR records. Keep the request tickets and revocation logs together so each grant can be traced to an approver and each removal to a dated action.

Authorized access list

ENISA lists an up-to-date list of people with authorized physical access as evidence. Reconcile this list against the badge system and HR records at a fixed interval, for example monthly or each quarter, and record the reconciliation as its own dated artifact. Mismatches between the list and active badges are the findings assessors most often test for, so note every correction and who made it.

Environmental threshold definitions

Point 13.2.2 requires minimum and maximum control thresholds for temperature, humidity, power and connectivity. Document each threshold, the reason for the value, the system it protects, and the owner who approved it. Thresholds should be reviewed after significant changes, such as new racks or a relocated room, and the review should be dated and signed. Without written thresholds, no out-of-range event can be judged.

Out-of-threshold event records

Monitoring tools, such as Prometheus scraping sensor exporters and Grafana Alerting firing on those metrics, produce the raw events. Keep the alert history, the acknowledgment, the response taken and the closure note for every breach outside the thresholds. Confirm that alert routing reaches a person on call and that rules were tested, since an alert that never fired is not evidence of control.

Test schedules and results

Point 13.1.3, 13.2.3 and 13.3.3 require physical and environmental measures to be tested, reviewed and updated regularly, or after significant incidents or changes. Keep a test calendar with dated results, such as generator load tests, fuel checks, door-forcing tests and camera coverage reviews. Link each retest to the change ticket or incident that triggered it, so the assessor can see that testing responds to change.

What meeting point 13 costs in money and effort

This table lists the cost components of meeting point 13 of Implementing Regulation 2024/2690, who is typically paid for each, whether it is one-time or recurring, and what drives it up or down. Use it to structure site-specific quotes, not as a budget, because no figures are supplied for these components.

Cost component	Who is paid	One-time or recurring	What drives the cost
Monitoring tooling and licenses	Software vendor or subscription provider, or the internal team for self-hosted tools	Recurring for commercial licenses and support, one-time for setup. Self-hosted open-source tools remove license fees but keep hosting and maintenance	Number of sites and data sources, alert volume, retention needs, and whether the organization already runs a monitoring stack
Sensor and facility hardware	Hardware vendor, facility contractor or electrical and HVAC installer	One-time for purchase and installation, recurring for replacement and calibration	Number of rooms with thresholds, whether existing building management systems expose readings, and the condition of cabling and power infrastructure
Engineering time to set thresholds and integrate alerts	Internal engineers or implementation partner under a written scope	One-time for initial thresholds and integration, recurring for changes after significant changes or incidents	Number of data sources to integrate, variety of sensor protocols, and how many threshold sets each facility needs
Utility and supply review	Internal facilities team, utility providers and fuel or emergency supply contractors	Recurring for fuel contracts and supply reviews, one-time for capacity studies	Whether power, telecom and fuel supply are contracted, and whether redundant utilities are in place or need to be assessed
Physical access administration	Internal facilities or security staff, and access control vendor for badge or door system support	Recurring for granting, revoking and reviewing access, one-time for the initial list of authorized persons	Staff turnover, number of entry points, contractor and visitor volume, and whether access is tied to identity management
Test and review effort	Internal staff or contractor performing tests of power, temperature, humidity, connectivity and perimeter controls	Recurring, on the schedule the organization sets and after significant incidents or changes	Number of facilities, test frequency chosen from the risk assessment, and how much testing is automated
External physical security testing or review	Specialist assessor or testing firm	Typically one-time per review cycle, with repeat engagements as needed	Number and type of sites, whether colocation facilities must be included, and the depth of testing agreed in writing
Auditor or assessor sampling time	Independent auditor or assessor, or the competent authority in its supervisory role	Recurring with each assessment cycle	Number of sites sampled, completeness of evidence such as test results and access lists, and the quality of the records kept

Which self-hosted open-source tools support the evidence

Point 13 asks for measured thresholds, monitored environmental parameters, and access records that can be reviewed. The tools below can produce parts of that evidence inside your own environment, but none of them replaces the physical controls, sensors or access procedures they report on. Confirm each fit against your facilities and access systems before you rely on it.

Grafana Alerting for threshold events

Grafana Alerting builds alert rules from queries and expressions across multiple data sources, and it can alert on metrics and logs together from one view. For point 13.2.2, this is the component that compares environmental readings against your minimum and maximum thresholds and records events outside them. Check that the license fits your deployment, since Grafana is licensed under AGPL-3.0-only, and confirm with counsel whether that affects how you run and modify it.

Prometheus for environmental metrics

Prometheus collects metrics from instrumented jobs over HTTP using a pull model and stores them as time series on local storage, queried with PromQL. It can hold power, temperature, humidity and connectivity readings for the monitoring tests required by points 13.1.2 and 13.2.2, but only where an exporter exists for your hardware. Confirm the exporter for each sensor or UPS model before planning the work. Prometheus is licensed under Apache-2.0, which is permissive, so license review usually focuses on the components around it.

midPoint for access reconciliation

midPoint runs access certification campaigns in which designated reviewers decide whether to keep, change or revoke access items within a set timeframe. This can support the periodic review of physical access grants under point 13.3 if those grants are modeled as roles or assignments in midPoint. Confirm that your badge or door access system can feed midPoint, because midPoint cannot review access it does not hold. midPoint is licensed under EUPL-1.2+, so confirm the license obligations for your distribution model.

Nextcloud audit logs are not access records

Nextcloud's admin_audit app writes additional event information to audit.log in the data directory, or to a path set with logfile_audit. These records describe application events, not who entered a building or server room. Do not present them as physical access evidence to an assessor. Physical access records must come from your door, badge or visitor systems, and you should confirm that their retention and review meet your own policy. Nextcloud is licensed under AGPL-3.0-only, and its license terms apply to how you deploy it.

Who does what for physical and environmental controls

Your organization owns every physical and environmental control in the scope of point 13 of the Annex to Implementing Regulation 2024/2690. Management sets the risk appetite behind the control thresholds and decides whether residual risk is acceptable. Facilities and IT operate the day-to-day controls: the power and cooling systems, the sensors, the badge and visitor records, and the test logs that show the controls work.

Management approval: Management approves the minimum and maximum thresholds for temperature, humidity, power and connectivity, and formally accepts any residual risk from the risk assessment.
Utilities and supply: Facilities owns the utility dependencies, redundancy decisions, emergency fuel contracts and the list of protected power and telecommunications lines.
Sensors and alerts: IT or facilities owns the monitoring of environmental parameters, the escalation path for out-of-threshold events and the reporting of those events.
Access lists and reviews: Facilities and security staff own the list of people with authorized physical access, the grant and revocation records and the periodic reconciliation against HR leavers and contractor end dates.
Test records: Facilities and IT keep the test schedule, the results and the updates made after incidents or significant changes.

Before engaging anyone, confirm that a named owner exists for each of these items and that the owner can produce the records on request.

Where organizations fall short on physical and environmental security

The gaps below share a pattern: controls are assumed to work because a vendor, landlord or colocation provider set them up once. IR 2024/2690 point 13 asks the entity to set, watch, record and test these controls itself, with evidence a supervisor can inspect.

Thresholds set once and never reviewed

Temperature, humidity and power limits are often inherited from the building vendor's installation defaults and never checked against the entity's own risk assessment. Point 13.2.2 requires minimum and maximum control thresholds for physical and environmental threats. Check that each threshold has a documented rationale, an owner and a review date, and that the values match the equipment the room actually houses.

No record of out-of-threshold events

Sensors may alarm on a local panel or to a facilities mailbox, but nothing shows who saw the reading, what they did and when it was closed. Point 13.2.2 requires the entity to monitor environmental parameters and report events outside the thresholds. Confirm that readings flow into a central monitoring system with timestamps, that alerts route to a named responder, and that each excursion has a closed ticket. Grafana Alerting can build such rules from sensor metrics, though the sensor feed itself must be confirmed for each site.

Access lists that drift from HR records

Badge systems keep granting entry to staff who have left, and contractor access often runs on a badge issued for an earlier project. ENISA's June 2025 guidance lists an up-to-date list of people with authorized physical access and procedures for granting and revoking it as evidence. Reconcile the badge list against HR and contractor records each month, and tie revocation to offboarding tickets so that a departure removes physical access on the same day as system access.

Emergency fuel and power never tested

Generator contracts and fuel delivery agreements often exist on paper, but nobody has checked that the fuel supplier responds, that the tank holds the volume the contract assumes, or that the transfer switch operates under load. Point 13.1.2 expects emergency supplies such as fuel for emergency power to be contracted, and point 13.1.3 requires testing. Ask for dated test records, the supplier's response time commitment and the last load bank or failover test result.

Colocation controls assumed, not requested

Many organizations hosting in a colocation facility assume the provider's physical controls meet their needs without asking. Point 13.3 applies to the entity's own facilities and the environment it relies on, so the entity needs written evidence: the provider's perimeter design, visitor logs, camera retention, and environmental test records. Put a request for these artifacts into the contract and schedule a yearly review of the provider's answers. Where the provider cannot produce them, record that gap as a supply chain risk.

No test after significant change or incident

Physical controls are often tested at installation and then left alone, even after a cooling upgrade, a new rack layout or a break-in attempt. Points 13.1.3, 13.2.3 and 13.3.3 require testing, review and updating regularly and after significant incidents or significant changes. Build a trigger list into change management so that facilities changes and physical security incidents automatically open a retest task, and keep the results with the risk assessment so an assessor can trace the link.

Questions buyers ask about point 13 before hiring help

How much effort does point 13 take for a single server room compared with a data center?

The effort scales with the number of facilities, the number of utilities each one depends on, and how much physical access control already exists. A single server room usually has one power feed, one cooling path and one access door, so the work is mostly documenting thresholds, monitoring and access procedures. A data center has more supporting utilities, more perimeter layers and more people with access, so the same requirements produce more sites to define, more monitored parameters and more test records. Point 13.1.2 asks entities to consider redundant utilities where appropriate, which is a design decision that can drive the largest one-time cost. Ask any partner to size the work from a written inventory of your facilities and their dependencies.

Can our own team handle point 13 without an outside partner?

Often yes, if the team owns the facilities, the power and cooling plant, and the access control systems. Point 13 mostly asks for documented decisions, defined security perimeters based on your risk assessment, monitored thresholds, and regular tests. Those tasks sit with facilities, operations and security staff who already know the site. Outside help tends to add value where the team lacks monitoring integration, needs to set up open-source alerting such as Grafana Alerting with Prometheus for environmental data, or needs an independent review before a supervisor inspection. The organization remains responsible for its controls in every case.

What does our team need to supply before a partner can start?

A partner needs access to the facts that point 13 depends on. Typical inputs include:

A list of sites and the utilities each one relies on, such as power, cooling, water and telecommunications lines
The current physical security policy, access grant and revoke procedures, and the list of people with authorized physical access
Existing sensor data, alarm settings and any environmental monitoring already in place
The most recent risk assessment, prior test results and incident records for the facilities

Missing inputs usually extend the discovery phase, so confirm them in writing before the scope is agreed.

How long does point 13 preparation usually take?

The duration depends on the number of sites, how much of the requirement already exists in documented form, and how much monitoring must be built. DeployOpen agrees a fixed scope, deliverables and timeline in writing before work starts, so the timeline comes from that agreed scope rather than from a general assumption. No duration is assumed on this page. Ask any provider to show which tasks are inside the timeline, which depend on your facilities team, and which depend on hardware or vendor delivery.

Does a colocation provider's certificate cover point 13 for us?

A colocation provider's certificate or report does not replace your own evidence unless its scope explicitly covers the controls you need and the report is issued by an independent auditor. Point 13 applies to the entity, so you still need records of your own access grants, your own threshold monitoring for the equipment you run, and your own test results. Ask the provider for its report scope, the period it covers, and the exact points it addresses, then map those to your obligations with your auditor or advisor before relying on them.

What drives the cost of point 13 work?

The main cost drivers are the number of facilities, the redundancy of utilities you choose to build, the sensor and monitoring coverage you need, and the amount of access control hardware and process work required. Costs fall into one-time items, such as the initial review, threshold design, monitoring setup and documentation, and recurring items, such as periodic testing, review and updating after significant changes or incidents. When asking for a quote, request a written scope that separates design, implementation, documentation and testing, and states which items are one-time and which recur.

Does an auditor or authority issue a NIS2 certificate for point 13?

No. NIS2 creates no certificate of compliance. National competent authorities oversee compliance through inspections, security audits, security scans, information requests and administrative fines. An independent auditor or certification body may issue a report or certificate under another framework you choose, but that is separate from NIS2 supervision. DeployOpen prepares systems, controls and evidence for assessments and does not issue audit reports or certifications. Confirm with your national authority which evidence it expects for physical and environmental security.

How DeployOpen prepares physical and environmental evidence

DeployOpen works on point 13 of the Annex to Implementing Regulation (EU) 2024/2690 inside your own facilities, data centers and cloud accounts, where the physical and environmental controls actually operate. We prepare the systems, monitoring, procedures and records that show those controls are defined, tested and kept current, while your organization keeps ownership of its controls and decisions.

How we scope

Written scope names the sites, data centers and rooms where supporting utilities and access controls apply
Risk assessment inputs set the security perimeters and the thresholds for each environmental parameter
Scope lists the utilities, power, cooling, connectivity and emergency fuel arrangements covered by point 13.1
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts

How we build

Environmental monitoring is configured to track power, temperature, humidity and connectivity against defined minimum and maximum thresholds
Alert rules route out-of-threshold events to responders, with Grafana Alerting and Prometheus as candidate open-source components to confirm for your environment
Physical access records and badge or entry logs are structured so the authorized-person list can be produced on request
Test plans for utility failover and threshold alarms are written so results can be recorded and repeated

How we hand over

Physical security policy, access granting and revocation procedures, and the authorized access list are delivered as documents
Test schedules, test results and review records are delivered in a form your assessor or supervisor can inspect
Configuration, thresholds and perimeter definitions are documented so your staff can maintain them after handover
Independent auditors and competent authorities, not DeployOpen, decide whether the evidence meets the requirement

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement
Reviews are scheduled after significant incidents or significant changes to facilities, as point 13 requires
Periodic re-testing of utility and environmental controls can be included in a retainer scope agreed in writing
Your team owns the final control decisions, and we confirm each support item against the written scope