How is physical access governance different from access control?

Access control enforces access at the door, whether by badge, key or code. Governance decides and proves who should have that access in the first place, based on identity, role and policy.

Is physical access governance required by NIS2 or CER?

Both directives require governed, demonstrable control over physical access to premises and infrastructure. Neither prescribes a specific technology, but manual key administration struggles to meet the demonstrability requirement.

Does physical access governance require replacing locks?

No. It is a middleware layer that connects the IAM system and the digital locking system an organization already runs.

What is Physical Access Governance?

Q: What is physical access governance?

Physical access governance is the practice of managing physical access rights, such as keys and lock permissions, through identity-driven controls: rights derived from roles, granted through policy and approval, revoked automatically when identities change, and recorded in an audit trail. It connects IAM systems to physical locking systems.

Why the category exists

For decades, digital and physical access grew up as separate worlds with separate owners. IT built identity governance: joiner-mover-leaver processes, role models, approval workflows, recertification, audit trails. Facilities managed keys: issue registers, key cabinets, deposit forms, and a great deal of institutional memory.

That separation was tolerable when keys were purely mechanical and expectations were low. Three developments ended it:

Digital locking systems matured. Technologies like iLOQ and ASSA ABLOY CLIQ made key rights programmable, which means they can be governed, if something feeds them the right decisions.
Regulation caught up. The EU's NIS2 Directive requires appropriate policies for access to premises, and the CER Directive requires critical entities to secure their physical infrastructure. Physical access moved from a facilities detail to a board-level compliance topic.
The threat model converged. Whoever enters a server room, switch room or relay house physically can compromise the digital systems inside. Separating the two governance worlds stopped making security sense.

Physical access governance is the discipline that reunites them.

What physical access governance consists of

Identity-driven provisioning. Key rights derive from who someone is and which roles they hold in the IAM system, not from who happened to ask at the desk.
Policy and approval. Which role opens which doors is defined once, as policy, and exceptions pass through approval instead of around it.
Lifecycle enforcement. Joiners receive access with their role, movers lose the old and gain the new, and leavers lose everything in the same movement that disables their accounts. Contract end dates end physical access too.
Audit and evidence. Every grant, change and revocation is logged, tamper-evident, and traceable to an identity and a decision, so compliance questions are answered from the system.

In practice this is implemented as middleware, such as Key2XS, sitting between the IAM system and the locking system, translating identity decisions into key rights in near real-time.

How it differs from adjacent categories

Category	What it does	What it does not do
Key management software	Registers which keys exist and who holds them	Does not connect to identity: issuance and revocation remain manual decisions
Electronic access control (badges, PACS)	Controls wired doors with badge readers, often in buildings	Does not cover the key-operated estate: dispersed sites, cylinders, padlocks, technical spaces
IAM / identity governance	Governs digital identities, roles and application access	Stops at the digital boundary: no connection to physical keys
Physical access governance	Applies IAM governance to key-based physical access	Does not replace any of the above: it connects the IAM to the locking system

The categories are complementary. Most critical entities run all of them, and physical access governance is the layer that makes the key-operated part of the estate as governable as the badge-operated and digital parts.

Who needs it

Physical access governance matters most where physical access affects safety, continuity or compliance:

Utilities: thousands of dispersed, unmanned sites where the key is the entire security model
Government: diverse estates, many external hands, and public accountability, under BIO and NIS2
Transport: safety-critical trackside and depot access with layered contracting
Healthcare: medicine rooms, wards and archives with a workforce in constant motion, under NEN 7510
Industry: control rooms, chemical storage and turnaround influxes of contractor workers

The common trigger is regulatory: organizations in scope of NIS2 or CER discover that their digital governance is mature while their physical access is still administered by hand, and that auditors have started asking about both.

A maturity model for physical access

Stage 1: The register. Keys are tracked in a spreadsheet or paper register. Accuracy depends on discipline and decays continuously. Audits are reconstructions.
Stage 2: Key management software. A dedicated system tracks keys and holders. The registration is better, but every grant and revocation is still a manual decision, disconnected from the identity lifecycle.
Stage 3: Programmable locks. Digital locking (iLOQ, CLIQ) makes rights changeable without physical key retrieval. Revocation becomes possible in minutes, but someone still has to remember to do it.
Stage 4: Governed. Middleware connects the IAM to the locking system. Rights derive from roles, lifecycle events propagate automatically, and the audit trail is produced as a byproduct of normal operation. Nobody has to remember anything.

Most organizations that feel physical access pain are at stage 2 or 3: they own capable systems on both sides and lack only the connection between them.

A buyer's checklist

When evaluating a physical access governance solution, ask:

Does it connect to the IAM system we already run, with pre-built, maintained connectors?
Does it work with our existing locking system without replacing locks, keys or the locking plan?
How fast do lifecycle events propagate, and is revocation near real-time?
Is the audit trail tamper-evident and does it link every right to an identity and a decision?
Are the integrations certified by the vendors on both sides?
What is the realistic implementation time, and does it require custom development?
Does it handle external populations, such as contractors and agency staff, with automatic end dates?

Key2XS answers these by design: certified integrations on both sides (SailPoint Technology Alliance Partner, certified by ASSA ABLOY), pre-built connectors for SailPoint, Entra ID, Okta, One Identity and OpenText and for iLOQ and the ASSA ABLOY CLIQ ecosystem, near real-time propagation, a tamper-evident audit trail, and standard integrations live in under two hours.

What is physical access governance?