Protecting a data center starts with knowing what is happening.

A clogged air filter, an unexpected malfunction, or a drone over the premises. The continuity of a data center is not determined solely by servers, power supplies, and cooling. The environment changes constantly. Therefore, anyone managing critical IT infrastructure must be able to detect deviations early on.

That is the core of the keynote The continuous struggle against the elements by Leon van der Valk, Chief Information Security Officer at SPIE Netherlands, during IT Infra 2026. Van der Valk examines the resilience of data centers and computer rooms from various perspectives: that of the designer, manager, security officer, and supervisor.

Knowing what is happening inside and outside

According to Van der Valk, security begins with insight. Sensors and building management systems make it possible to monitor processes and conditions in and around a data center. The goal is not to collect as much data as possible, but to identify anomalies before they lead to a disruption.

A practical example sounds almost banal. Large numbers of insects can clog filter systems. This illustrates how broad the risk profile is. Van der Valk also mentions a drone approaching a site. A risk that received little attention a few years ago may now be a reason to reassess existing security measures.

That is precisely why he considers monitoring a safety measure. Those who quickly detect deviant behavior can intervene sooner and limit the potential consequences of a disruption.

The threat landscape is shifting.

This shifts the question from "what security do we have?" to "does our security still fit today's situation?" According to Van der Valk, a security organization must constantly monitor internal and external changes. New risks subsequently belong in the risk analysis and ultimately on the table for those who decide on measures and investments.

This approach aligns with the Dutch Cybersecurity Act (Cbw), which transposes the European NIS2 Directive into Dutch law. Organizations subject to the Act must conduct a risk analysis and, based on this, take appropriate and proportionate measures to secure their network and information systems. The Cbw has been in force since August 15, 2026.[1]

Physical and digital resilience are also becoming increasingly intertwined. The Critical Entities Resilience Act focuses on physical threats such as sabotage and natural disasters, while the Cbw sets requirements for cybersecurity and risk management.[2]

From sensor to organization

With this, resilience goes beyond technology. Van der Valk advocates for a professional security organization that can translate the changing threat landscape into design, management, and decision-making.

During IT Infra, he shows how various stakeholders view the same infrastructure and which risks become visible in the process. The keynote is on November 25 from 13:30 to 13:55.

Anyone responsible for a data center, server room, or other critical IT infrastructure is thereby given a concrete question: Do you only know how your infrastructure is designed, or do you also know what is happening to it right now?

look at it complete IT Infrastructure program

[1] Cybersecurity Act (NIS2) | NCSC

[2] Cybersecurity Act (NIS2 Directive) and Critical Entities Resilience Act (CER Directive) | VNG