EssentialNIS2 and physical security of IT and OT interfaces
The NIS2 Directive takes a risk-based approach to cybersecurity and includes the physical environment of network and information systems. As part of their own risk assessment, organisations can consider whether physically protecting accessible interfaces and connected cables is a useful complementary measure. The directive does not prescribe a specific product.
Securing unused ports
Open interfaces on accessible devices can provide an opportunity for unauthorised connections. Mechanical port locks restrict physical access to suitable unused ports. Examples are listed below. Check the device and port before choosing a product.
USB Port Lock / CSK-UL10 · Network Port Lock Plus / CSK-NL11
Securing connected cables
Where cables remain connected for operation, the aim is different: a cable lock can make unauthorised removal of the connection more difficult. The choice depends on the cable, port and operating environment.
Questions and answers
Does NIS2 require USB port locks?
No. Article 21 lists risk-based measures and access control policies, but does not prescribe a particular port lock product.
What is the difference between a port lock and a cable lock?
A port lock restricts access to an unused port. A cable lock makes it harder to remove a cable that is already connected. Suitability depends on the product and port.
Does using a port lock mean NIS2 compliance?
No. Compliance depends on the requirements applicable to the organisation and an appropriate overall package of measures.
How do I find a suitable solution?
First check whether a port is unused or an existing connection needs securing. Details of the device, port and environment help with the choice.
Products and contact
Explore suitable solutions for USB interfaces and network security. Contact our team with questions about the device, port and operating environment.
ContactSources and context
Physical locks complement organisational and technical measures. They do not replace a risk assessment, physical access rules, access rights management, monitoring, training or measures to detect and handle incidents. Whether and how NIS2 or national rules apply to an organisation must be assessed separately. SMARTKEEPER products alone do not guarantee NIS2 compliance.
Directive (EU) 2022/2555, Article 21 · Commission Implementing Regulation (EU) 2024/2690, Annex, Sections 11 and 13
Only within its respective scope of application.
Sources reviewed: 29 October 2026. This information does not replace legal advice.