---
title: Keeping Rotterdam’s Refineries Safe with Key2XS and Proving CER Compliance
description: How Rotterdam's refineries can keep people and processes safe with governed physical access from Key2XS, and prove CER compliance.
image: https://key2xs.com/hubfs/19294161_m.png
---

[![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg) ![Key2XS](https://key2xs.com/hubfs/img/logo-blue-horizontal.svg)](https://key2xs.com/?hsLang=nl)

 Why Governance?

[Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl) [CER Directive](https://key2xs.com/cer-directive?hsLang=nl) [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl) [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl) Analyst recognition [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl)

 Industries

[Government](https://key2xs.com/sectors/government?hsLang=nl) [Utilities](https://key2xs.com/sectors/utilities?hsLang=nl) [Water management](https://key2xs.com/sectors/water-management?hsLang=nl) [Transport](https://key2xs.com/sectors/transport?hsLang=nl) [Telecom](https://key2xs.com/sectors/telecom?hsLang=nl)

 Platform

[Product](https://key2xs.com/products?hsLang=nl) [How it works](https://key2xs.com/?hsLang=nl#how-it-works) [Integrations](https://key2xs.com/integrations?hsLang=nl) [Book a demo](https://key2xs.com/contact?hsLang=nl)

 Partners

Technology partners [SailPoint](https://key2xs.com/sailpoint-partnership?hsLang=nl) [One Identity](https://key2xs.com/partners/one-identity?hsLang=nl) [Microsoft Entra ID](https://key2xs.com/partners/entra-id?hsLang=nl) [Okta](https://key2xs.com/partners/okta?hsLang=nl) [OpenText](https://key2xs.com/partners/opentext?hsLang=nl) [iLOQ](https://key2xs.com/partners/iloq?hsLang=nl) [ASSA ABLOY](https://key2xs.com/partners/assa-abloy?hsLang=nl) Resell & Implementation partners [Hanab](https://key2xs.com/partners/hanab?hsLang=nl)

 Resources

[Resource center](https://key2xs.com/resources?hsLang=nl) [KuppingerCole Rising Star 2026](https://key2xs.com/analyst-recognition?hsLang=nl) [Events](https://key2xs.com/events?hsLang=nl) Meet us at Navigate [Navigate Austin · Oct 5-8](https://key2xs.com/events/sailpoint-navigate-austin?hsLang=nl) [Navigate London · Nov 2-4](https://key2xs.com/events/sailpoint-navigate-london?hsLang=nl) [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl) [FAQ](https://key2xs.com/?hsLang=nl#faq)

[News](https://key2xs.com/news-archive?hsLang=nl) 

[Book a demo](https://key2xs.com/contact?hsLang=nl) 

[Book a demo](https://key2xs.com/contact?hsLang=nl)

[← The Key2XS journal](https://key2xs.com/news-archive?hsLang=nl)  
Compliance

# Keeping Rotterdam’s Refineries Safe with Key2XS and Proving CER Compliance

Sep 08, 2025 · 6 min read · by the Key2XS team

![Keeping Rotterdam’s Refineries Safe with Key2XS and Proving CER Compliance](https://key2xs.com/hubfs/19294161_m.png)

**In short:** Rotterdam's refinery cluster concentrates people, hazardous processes and critical assets that must run safely around the clock. Key2XS gives operators governed, identity-linked control over physical keys — and the audit trail to prove CER compliance to authorities.

# **Keeping Rotterdam’s Refineries Safe with Key2XS and Proving CER Compliance**

Rotterdam is Europe’s energy heartbeat. The port cluster hosts **five major refineries** and allied chemical sites an enormous concentration of people, assets, and hazardous processes that must run safely every hour of the year.    
Over the last few years the risk picture has sharpened. Power disturbances in the area have shown how quickly operations can be impacted, while global incidents at oil & gas hubs underline the reality of hybrid (physical + cyber) threats. 

Read more on the need of cyber resilience at the Port of Rotterdam [here.](https://www.rotterdammaritimecapital.com/news/the-need-for-cyber-resilience-in-mainport-rotterdam)

At the same time, Europe’s [Directive on the Resilience of Critical Entities (CER, EU 2022/2557)](https://eur-lex.europa.eu/eli/dir/2022/2557/oj) is reshaping how critical operators must manage physical resilience, including insider risk and sabotage. Member States were required to transpose CER by **17 October 2024**, with national regimes now rolling out; in the Netherlands, the [Wet Weerbaarheid Kritieke Entiteiten (Wwke)](https://www.nctv.nl/onderwerpen/cer--en-nis2-richtlijnen/wat-zijn-de-cer-en-nis2-richtlijnen) and the **Cyberbeveiligingswet (Cbw)** were submitted to Parliament on **17 June 2025**. Operators in scope should prepare now. 

This article shows how **Key2XS** helps Rotterdam’s refineries enhance safety and demonstrably meet CER obligations by **bridging digital identity (IAM) with electronic key systems** to control, monitor, and audit all physical access.

 

## **Why keys are still your biggest blind spot**

Even highly automated plants depend on **mechanical and electronic keys** for valves, cabinets, MCC rooms, substations, tank farm gates, rail racks, and vendor skids. In practice, risks concentrate around:

- **Standing privileges**: long-lived keys that outlast jobs, shifts, or contracts.
- **Contractor access**: dozens of service firms on site during turnarounds and brownfield works.
- **Distributed assets**: remote pump stations, jetties, and pipe corridors far from the control room.
- **Audit gaps**: incomplete, manual logs when authorities or insurers request evidence.

CER explicitly calls out resilience against **natural hazards, sabotage, and insider threats** areas where unmanaged keys become weak links. 

 

## **What Key2XS does (in refinery terms)**

**Key2XS** connects your **electronic key system** (e.g., [ASSA ABLOY CLIQ](https://www.assaabloy.com/nl/nl/solutions/topics/digital-access-solutions/cliq); [iLOQ](http://www.iloq.com)) to your **Identity & Access Management (IAM)** (e.g., [Microsoft Entra ID](https://www.microsoft.com/nl-nl/security/business/identity-access/microsoft-entra-id), [SailPoint](http://www.sailpoint.com), [Okta](http://www.okta.com), [One Identity](http://www.oneidentity.com) and others). The result is a single policy plane for both digital and physical access:

1. **Role- & shift-based keys (JIT)**
   
   Keys are **activated just-in-time** for specific work orders, assets, and time windows, then **auto-expire**. No more standing privileges.
2. **Permit-to-Work alignment**
   
   Only keys linked to an authorised job step (LOTO, hot work, confined space) can be activated; scope changes revoke access instantly.
3. **Contractor onboarding/offboarding**
   
   Vendors are onboarded via IAM; **no IAM identity = no key**. Company exits or contract end dates revoke keys automatically.
4. **Realtime visibility & audit**
   
   Every activation, use, and failed attempt is logged and streamed to SIEM/SOC. Auditors get **tamper-evident trails**down to cylinder level.
5. **AI keyplan governance**
   
   Key2XS’ AI proposes **least-privilege keyplans** from roles, org charts, and uploaded infrastructure data; it flags SoD conflicts and over-provisioning.
6. **Incident response**
   
   Lost key? Suspected insider? **Remote kill** deactivates keys and blocks affected zones. Access can be re-issued for emergency crews in minutes.

 

## **Mapping Key2XS to CER obligations**

| **CER focus area** | **What the Directive expects** | **How Key2XS helps you evidence compliance** |
| --- | --- | --- |
| **Risk assessment & measures** | Identify critical operations; implement proportional resilience measures; address insider threats and sabotage. | Replace standing privileges with JIT activation; enforce least-privilege keyplans; maintain end-to-end access telemetry for insider-risk analytics.  |
| **Incident management** | Prevent, respond to, and recover from disruptions. | One-click revocation; geo/asset scoping; auditable timelines for post-incident reports and insurer queries. |
| **Supply-chain resilience** | Manage dependencies and third parties safely. | Contractor keys tied to IAM identities, PO/WO numbers, and time-boxed permits; automatic offboarding upon contract end. |
| **Reporting & oversight** | Demonstrate preparedness to the national competent authority. | Exportable, time-stamped access logs and control attestations; metrics dashboards aligned to refinery KPIs. |
| **Coordination with cyber ([NIS2](https://key2xs.com/nis2-directive?hsLang=nl))** | Align physical and cyber resilience. | Stream physical-access events into SIEM/SOC; correlate with OT/IT alerts to spot hybrid attack patterns. |

(For background on CER scope, timelines, and national transposition, [see the European Commission’s overview](https://home-affairs.ec.europa.eu/policies/internal-security/counter-terrorism-and-radicalisation/protection/critical-infrastructure-resilience-eu-level_en)and enforcement updates, plus [Dutch legislative status](https://wetgevingskalender.overheid.nl/Regeling/WGK014624))

 

## **A refinery-ready rollout (90 days to value)**

**Weeks 0–2 – Foundations**

- Connect IAM (Entra/HRIS) and import refinery roles (operations, maintenance, turnaround, HSE).
- Ingest asset registry (areas, units, cabinets, substations) and map cylinders/locks.
- Define **critical zones**: crude & vacuum units, hydroprocessing, tank farms, jetties, substations, control rooms.

**Weeks 3–6 – Pilot & JIT**

- Select one area (e.g., **hydrocracker** or a **substation cluster**) for pilot.
- Turn on **JIT keys** for maintenance and emergency teams; integrate access telemetry into SIEM.
- Align Permit-to-Work: only authorised tasks can trigger key activation

**Weeks 7–10 – Scale & automate**

- Expand to contractors, scaffolders, NDT crews, and turnaround firms.
- Enable **AI keyplan** and SoD checks; automatically flag excess or overlapping access.

**Weeks 11–13 – Prove & optimise**

- Report **KPIs**: % JIT vs standing access, time-to-revoke, audit exceptions, MTTR for hybrid incidents, contractor onboarding time.
- Prepare **CER evidence pack**: policies, process diagrams, sample logs, and monthly control attestations.

 

## **High-impact refinery use cases**

1. **Turnaround season control**
   
   Thousands of extra workers and dozens of vendors enter site gates. Key2XS issues **time-boxed keys bound to work packages** and revokes them when scopes close shrinking insider and theft exposure that rises during TARs. (Rotterdam’s recent large turnarounds show the vendor scale involved.) 
2. **Substation & jetty safety**
   
   OT alarms and grid events can coincide with physical access to high-energy zones. Key2XS correlates **physical entry attempts with SIEM alerts** to spot hybrid activity and prevent mis-operations. (A 2024 grid disturbance in the port illustrated how sensitive operations are to power anomalies.) 
3. **ARA-hub threat awareness**
   
   The Amsterdam–Rotterdam–Antwerp hub has seen security-relevant incidents in recent years; resilience is non-negotiable. Key2XS helps enforce least-privilege at the lock, not just the firewall. 

 

## **What auditors and authorities will ask and how you answer**

- **Who can open this cabinet/valve/room right now, and why?**
  
  → Show the **role-based entitlement** and the **active JIT grant** bound to a job step.
- **How fast can you revoke all access for vendor X?**
  
  → **Immediate revocation** via IAM; all keys for that vendor’s identities are deactivated and logged.
- **Prove no one had standing access to Unit 2 during hot work.**
  
  → Export the **access window ledger** for Unit 2 and the task IDs; logs show failed attempts outside the window.
- **Demonstrate alignment with CER & Wwke.**
  
  → Provide your **policy mappings**, resilience measures, SIEM correlation playbooks, and monthly control attestations.

 

## **Integration landscape (typical)**

- **IAM / HR**: Microsoft [Entra ID](https://key2xs.com/integrations/entra-id-iloq?hsLang=nl), [SailPoint](https://key2xs.com/integrations/sailpoint-iloq?hsLang=nl), IdentityNow, Okta, One Identity, OpenText
- **Key systems**: [ASSA ABLOY CLIQ](https://key2xs.com/integrations/assa-abloy-cliq?hsLang=nl), [iLOQ](https://key2xs.com/integrations/iloq?hsLang=nl)
- **OT/IT telemetry**: Splunk, Microsoft Sentinel, Elastic, QRadar
- **Work management**: SAP PM, Maximo, e-PTW

Key2XS sits in the middle, enforcing **“no identity, no key”**, turning every cylinder into a **managed endpoint** and every key into a **revocable, auditable token**.

 

## **Action checklist for Rotterdam refinery leaders**

- Identify **critical zones and cylinders** that must move to JIT access first.
- Connect IAM and **eliminate standing physical privileges** in pilot areas.
- Stream physical access logs to SOC and **correlate with OT signals**.
- Align **Permit-to-Work** with key activation; block ad-hoc key issuance.
- Produce a **CER evidence pack** and rehearse an insider-threat tabletop.
- Extend to contractors and turnaround vendors before the next TAR.

 

### **Bottom line ![bluckeymonteur](https://key2xs.com/hs-fs/hubfs/bluckeymonteur.png?width=43&height=65&name=bluckeymonteur.png)**

[Recent incidents](https://www.reuters.com/business/energy/power-outage-rotterdam-port-area-resolved-electricity-grid-operator-says-2024-09-03/?utm_source=chatgpt.com)prove cyber resilience is not a luxury but a necessity. 

Rotterdam’s refining cluster cannot afford blind spots between digital and physical security. **Key2XS** closes that gap **shrinking attack surface, speeding incident response, and giving you the audit-ready trail** that CER expects.

![](https://key2xs.com/hubfs/1587550138006.jpeg)![](https://key2xs.com/hubfs/img/niels-bakker.png)![](https://key2xs.com/hubfs/1746630921693.jpeg)![](https://key2xs.com/hubfs/1696359051569.jpeg)

**Written by the Key2XS team**

Key2XS is founder-run. Questions about this piece land with the people who built the platform. [Talk to us](https://key2xs.com/contact?hsLang=nl).

## Keep reading

[![](https://key2xs.com/hubfs/2keyholekey2xs.png) **Bridging Worlds: How Logical and Physical Access Are Converging and Why Key2XS Is Out in Front**Aug 18, 2025](https://key2xs.com/news/bridging-worlds-how-logical-and-physical-access-are-converging-and-why-key2xs-is-out-in-front?hsLang=nl) [![](https://key2xs.com/hubfs/205665854_m.png) **Using Key2XS in the Transportation Sector under the CER Directive**Sep 22, 2025](https://key2xs.com/news/using-key2xs-in-the-transportation-sector-under-the-cer-directive?hsLang=nl) [![](https://key2xs.com/hubfs/key2xsplatform.png) **Direct Coupling vs. Key2XS Mediation: Two Paths to Managing Physical Key Systems with IAM**Sep 15, 2025](https://key2xs.com/news/direct-coupling-vs.-key2xs-mediation-two-paths-to-managing-physical-key-systems-with-iam?hsLang=nl)

## Govern the keys you already have

See identity, policy and physical keys in one 30-minute demo, scoped to your estate.

[Book a demo](https://key2xs.com/contact?hsLang=nl) [More in the journal](https://key2xs.com/news-archive?hsLang=nl)

### Contact us

[Wilhelmina van Pruisenweg 104, 2595 AN Den Haag](https://maps.google.com/?q=Wilhelmina+van+Pruisenweg+104+Den+Haag)

Kraanspoor 50, 1033 SE Amsterdam, The Netherlands 

[info@key2xs.com](mailto:info@key2xs.com) [+31(0)70 2045180](tel:+31(0)702045180)

### Platform

- [Why Physical Access Governance?](https://key2xs.com/physical-access-governance?hsLang=nl)
- [Product](https://key2xs.com/products?hsLang=nl)
- [Integrations](https://key2xs.com/integrations?hsLang=nl)
- [ROI calculator](https://key2xs.com/roi-calculator?hsLang=nl)

### Compliance

- [CER Directive](https://key2xs.com/cer-directive?hsLang=nl)
- [NIS2 Directive](https://key2xs.com/nis2-directive?hsLang=nl)
- [EU Enforcement Tracker](https://key2xs.com/cer-tracker?hsLang=nl)

### Company

- [SailPoint partnership](https://key2xs.com/sailpoint-partnership?hsLang=nl)
- [Resource center](https://key2xs.com/resources?hsLang=nl)
- [Events](https://key2xs.com/events?hsLang=nl)
- [News](https://key2xs.com/news-archive?hsLang=nl)
- [Contact](https://key2xs.com/contact?hsLang=nl)

[![Penetration tested and verified by Sekurno](https://key2xs.com/hubfs/img/badges/sekurno-pentest-badge-white.svg)](https://www.sekurno.com/verified/key2xs) [![KuppingerCole Analysts Rising Star 2026 badge for Key2XS](https://key2xs.com/hubfs/img/badges/kuppingercole-rising-star-2026-key2xs.svg)](https://key2xs.com/analyst-recognition?hsLang=nl)

---

![Key2XS](https://key2xs.com/hubfs/img/logo-white-horizontal.svg)

Key2XS, pronounced “key to access”

© 2026 Key2XS B.V. All rights reserved

<https://www.linkedin.com/company/key2xs>

[Privacy](https://key2xs.com/privacy-statement?hsLang=nl)  Cookie Preferences

Patent Pending Nr: 2040721 & 2041284

Key2XS & ActiveAuth are registered trademarks of Key2XS Assets B.V.

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Key2XS",
    "url" : "https://key2xs.com/news/author/key2xs-2"
  },
  "dateModified" : "2025-09-16T07:17:07.564Z",
  "datePublished" : "2025-09-08T07:00:00.000Z",
  "headline" : "Keeping Rotterdam’s Refineries Safe with Key2XS and Proving CER Compliance",
  "image" : [ "https://key2xs.com/hubfs/19294161_m.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://key2xs.com/news/keeping-rotterdams-refineries-safe-with-key2xs-and-proving-cer-compliance",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://key2xs.com/hubfs/logo%20blue.svg"
    },
    "name" : "Key2XS B.V."
  }
}
```