A new law has been introduced. It is called the Critical Entities Resilience Act, abbreviated as CERA (or Wwke in Dutch). For organizations that are part of the Netherlands’ critical infrastructure, it brings concrete obligations. Not just on paper, but demonstrably in practice.
The latter is precisely where many organizations struggle. Policy notes have been written. Risk analyses have been performed. Measures have been documented. But whether security actually holds up when someone puts it under pressure remains untested in most cases.
The CERA explicitly asks for more than that. And that makes physical penetration testing more relevant than ever.
What the CERA Requires
The Critical Entities Resilience Act is the Dutch implementation of the European CER Directive (Critical Entities Resilience). The law focuses on organizations in sectors essential to society: energy, drinking water, transport, banking, healthcare, digital infrastructure, and government.
The core of the law can be summarized simply: critical entities must be able to demonstrate that they are resilient against disruptions, sabotage, and unauthorized access. This requires three concrete steps.
- A risk analysis that maps out current threats, including physical and human risk factors.
- A resilience plan with concrete measures for access security, personnel screening, incident response, and business continuity.
- Periodic evaluation and demonstrable validation of those measures in practice.
That third step is crucial and, at the same time, the one most often skipped. Documentation describes what should work. Validation demonstrates what actually works.
“The question is not whether you have security measures. The question is whether they function when someone actually tests them.”
Physical Resilience: The Underestimated Component
In practice, security programs focus predominantly on digital risks. Firewalls, access management in systems, encryption, patch policies. This is understandable, as the threat is visible and the market for solutions is large.
But the CERA makes no distinction between digital and physical. The law demands resilience. And that starts at the front door.
Physical vulnerabilities are often remarkably accessible in practice:
- Employees holding doors open for strangers because helpfulness is simply part of the culture.
- Visitors walking unescorted to areas where they have no business being.
- Reception procedures that look correct on paper but are not consistently followed in practice.
- Technical rooms that are accessible via public zones without any significant barrier.
- Employees sharing sensitive information based on a convincing story from a stranger.
None of these vulnerabilities are visible in an IT audit. They become visible when someone actually tests them.
What a Physical Penetration Test Is and Is Not
A physical penetration test is a controlled attempt to gain unauthorized access to a building, department, system, or confidential information. The test is performed by trained specialists, within pre-defined frameworks and in full coordination with the client.
The latter deserves emphasis. A physical penetration test is not a surprise attack on employees. It is not a spectacular burglary operation. It is a methodical, professional assessment of the security measures an organization has implemented.
The approach follows fixed phases:
- Preparation: Alignment of objectives, threat profile, perpetrator profile, and Rules of Engagement.
- Observation and reconnaissance: Insight into the physical environment, routines, and behavioral patterns.
- Execution: Realistic scenarios in which access control, visitor processes, social control, and employee awareness are tested.
- Reporting: Concrete findings, evidence, risk interpretation, and practical directions for improvement.
The goal is not to catch or shame employees. The goal is to strengthen processes, measures, and awareness. That distinction also determines the tone of a good report.
How Physical Penetration Testing Aligns with the CERA
The CERA requires critical entities to periodically evaluate and demonstrate their resilience. Within this framework, physical penetration tests are not a luxury option, but a logical instrument.
First, they align directly with the risk analysis required by law. While a risk analysis describes threats based on assumptions and experiences, a penetration test makes visible which of those threats are achievable in practice. This provides the risk analysis with more concrete substantiation.
Second, they fulfill the validation obligation. Organizations must be able to demonstrate that their measures work. A report from a physical penetration test, including findings and follow-up, is stronger evidence for this than an internal policy audit.
Third, they strengthen the security awareness that the CERA implicitly demands. Employees who know that their organization is periodically tested are more alert. Not out of fear, but out of a sense of ownership.
“Compliance does not automatically mean resilience.”
The Connection with NIS2
The CERA does not stand alone. Parallel to it, the Cybersecurity Act—the Dutch implementation of NIS2—obligates essential and important entities to implement demonstrable security measures and periodic testing.
Although NIS2 is primarily associated with digital security, the law explicitly sets requirements for the physical security of systems and facilities, access control, personnel policy, and supply chain security. The physical and digital layers are inextricably linked in the NIS2 context.
For organizations falling under both the CERA and NIS2, an integrated physical security program, including periodic penetration tests, offers an efficient way to fulfill both obligations. Two laws, one approach.
Which Sectors Are Affected
The CERA focuses on organizations in sectors designated as critical. In the Dutch context, this includes:
- Energy: Electricity producers and distributors, gas grid operators, oil companies.
- Drinking water: Drinking water companies and operators of water treatment plants.
- Transport: Aviation, seaports, railways, road authorities.
- Banking sector and financial market infrastructure.
- Healthcare: Hospitals, laboratories, pharmaceutical manufacturers.
- Digital infrastructure: Data centers, cloud providers, internet traffic hubs.
- Government: Central government and, in certain cases, local authorities.
For all these sectors, physical access security, employee behavior, and the resilience of processes directly affect the continuity of critical services. A targeted attempt at unauthorized access is a realistic scenario in all these environments, not a theoretical assumption.
Periodic Testing as a Structural Choice
A one-time penetration test provides insight into the situation at that moment. But security is not a static state. Employees change. Processes change. Buildings are renovated. Threats evolve.
Organizations that test periodically build something structurally more valuable than an approved report: demonstrable resilience that is tracked and improved over time. This provides management information for leadership, substantiation for regulators, and confidence within the organization.
The CERA and NIS2 assume that security is a continuous process. In this context, physical penetration tests are not a one-off measure, but a recurring instrument in a mature security program. To make this continuity measurable, Cocoon brings the results of penetration tests together in a clear dashboard. This records findings per test, compares results over time, and provides insight into the progression of security maturity for management and regulators. In this way, periodic testing becomes not just an obligation, but an instrument for demonstrable growth—and the basis for a long-term partnership.
What This Means for Your Organization
If your organization falls under the CERA or NIS2, or if you work with critical processes, sensitive information, or an environment where unauthorized access has serious consequences, the question is not whether you should test your physical security. The question is when and how.
A physical penetration test does not result in an uncomfortable report. It provides insight. It makes visible what the organization is doing well and where improvement is possible. It strengthens awareness among employees and gives management concrete substantiation for investment decisions.
Security is only certain when someone actually tests it. The CERA makes that not only advisable, but demonstrably necessary.
“We don’t deliver a report. We build resilience.”