NIS2 and the Energy Efficiency Act: One Data Centre, Two Regulatory Pressures

Why cybersecurity and energy performance meet in the same physical systems
24 June 2026 · micara Compliance Team

In a modern data centre, a temperature sensor can appear almost trivial. It sits in a rack, measures the air or coolant and sends a stream of values to a monitoring platform. Yet the same small device participates in two very different obligations. Its data helps demonstrate energy performance. Its connection also forms part of an operational network that must be secured, monitored and understood.

This is where two regulatory regimes meet. NIS2 approaches the data centre as critical digital infrastructure whose disruption can affect customers and society. Germany's Energy Efficiency Act, the EnEfG, approaches it as a large and continuous energy consumer whose efficiency, electricity sourcing and waste heat must be addressed. One begins with security, the other with energy. Inside the facility, both arrive at the same equipment.

Treating them as wholly separate programmes may look administratively convenient. In practice, it can duplicate inventories, produce contradictory documentation and cause one remediation project to alter the scope of the other without warning.

NIS2 changes the status of the data-centre operator

For many years, data-centre regulation was felt mainly through planning, construction, electrical safety and energy cost. NIS2 changes the governance of operational risk. Data-centre services are explicitly included in the critical digital infrastructure landscape, bringing obligations that extend beyond the server hall.

Operators must determine their status, register where required, implement proportionate cybersecurity risk-management measures and prepare for staged incident reporting. Supply-chain security, continuity, access control, vulnerability handling and the effectiveness of risk measures all enter the operating model. Management accountability makes the subject a board responsibility rather than a technical matter that can be delegated and forgotten.

The practical standard is not the existence of a policy folder. It is a working system of management: current scope, named owners, rehearsed response, reliable evidence and an ability to show that controls operated over time. A cooling failure caused by compromised controls is not merely a facilities issue. If it disrupts the service, it is part of the cybersecurity and continuity story.

The EnEfG gives efficiency a hard edge

The EnEfG addresses another property of the same facility: the large difference between the electricity entering the site and the useful compute produced inside it. Cooling, pumps, fans, power conversion and other supporting systems consume energy without performing the IT workload itself. PUE expresses this relationship and has become both an engineering measure and a regulatory concern.

Efficiency requirements can therefore lead to physical intervention. An older cooling arrangement may need to be modernised. Monitoring may need to become more granular. Renewable-electricity requirements affect procurement. Waste-heat provisions require operators to consider how heat can be made available and whether a credible recipient or network exists.

These are not purely reporting tasks. A waste-heat connection may require heat exchangers, pumps, control logic, metering, external pipework and a commercial relationship with another operator. A change intended to satisfy the energy regime can create new assets, interfaces, suppliers and failure modes.

The cooling system is the point of convergence

Cooling is where the double pressure becomes easiest to see. It is one of the strongest levers available to reduce PUE. It is also operational technology whose loss or manipulation can threaten the availability of the data-centre service.

Improved energy monitoring adds sensors, gateways, communications and software. These produce the evidence required to understand efficiency, but each addition must also be inventoried, configured, patched where possible and included in incident detection. A geothermal loop may reduce mechanical cooling demand, yet its pumps, valves, controllers and interfaces join the operational environment as soon as the system is commissioned. A heat-offtake connection creates a physical and digital boundary with an external organisation.

Thus, the same project can improve energy performance while enlarging cyber scope. This is not an argument against modernisation. It is the reason modernisation should be designed jointly.

The cost of two disconnected programmes

If security and energy teams work from different maps, they may name the same asset differently or omit it from one scope altogether. Facilities staff may install connected equipment before security requirements are defined. Cyber teams may harden a control network without understanding that the data it carries must also support statutory performance evidence. Procurement may place conflicting obligations on the same supplier.

The duplication is expensive, but inconsistency is the greater risk. At audit or during an incident, two authoritative inventories cannot both be correct if they describe different systems. Nor can an organisation claim efficient control of its infrastructure if it has to rediscover that infrastructure for each regulatory purpose.

A shared technical foundation is more economical. One asset and interface inventory can support different legal outputs. One change-management process can ask both energy and security questions. One architecture can show how cooling, monitoring, power, waste heat and external services depend on each other.

What investors should price

For an acquirer or lender, both regimes create post-closing exposure. A NIS2 gap may require governance, staffing, monitoring, segmentation or incident-response capability. An EnEfG gap may require cooling works, renewable procurement or heat infrastructure. These costs do not remain neatly separated.

A cooling retrofit changes the OT environment. New meters create data flows. A heat connection creates an outside interface and may introduce availability dependencies. Security requirements can alter vendor selection, remote access and lifecycle cost. The correct due-diligence question is therefore not simply whether the asset complies with each regime. It is what the combined remediation programme will cost, when it must be delivered and how one measure changes another.

The answer belongs in the financial model. It should distinguish immediate obligations, planned improvements, capital projects and recurring operating cost. It should also identify the dependencies that could make a nominally simple measure difficult: a heat-network operator not yet committed, a cooling design not compatible with future rack density, or an OT estate without reliable ownership.

Begin with one truthful picture of the facility

The most useful starting point is a combined assessment. Determine scope under both regimes. Build a shared inventory of relevant IT, OT, energy and cooling assets. Map external interfaces and suppliers. Identify where the obligations overlap and where they remain distinct. Then order remediation by deadline, service risk and cost interaction.

The legal reports may ultimately be separate because the laws ask different questions. The engineering beneath them should not be. A data centre has one set of cables, pumps, control systems, sensors and people. It has one operating reality.

Regulation has merely made that reality harder to ignore. The facility that can describe it once, accurately and in sufficient detail, is better placed to secure its services, control its energy use and invest without paying twice for the same understanding.