- Ana
Your board room has a video bar with default credentials. Your control room wall processor still runs firmware from its commissioning day. Neither appears in the IT asset register, and both sit on the corporate network. If your organisation is covered by NIS2, those devices are now part of a risk-management obligation your management body has to approve and can be held accountable for.
Key takeaways
- NIS2 does not name AV equipment, but its risk-management measures apply to all network and information systems, which includes networked meeting room and control room technology.
- The directive explicitly lists secured voice, video and text communications among the minimum measures (Article 21(2)(j)).
- In Romania, NIS2 applies through GEO 155/2024, approved by Law 124/2025. Registration with DNSC opened in August 2025.
- The most common AV gaps are practical: unmanaged firmware, default passwords, flat networks, unrestricted vendor remote access and no AV asset inventory.
- Securing AV is mostly a design and operations discipline: segmentation, hardening, patching, access control and supplier management.
Why NIS2 reaches your meeting and control rooms
The NIS2 Directive (EU 2022/2555) requires essential and important entities to manage the cybersecurity risks of their network and information systems. It does not list device types. A networked camera, a codec or a video wall controller is a network-connected system, so it sits inside that scope by default.
Three provisions matter most for AV:
- Article 21 (risk-management measures). Ten minimum measures, from asset management and access control to supply chain security. Point (j) explicitly covers multi-factor authentication and secured voice, video and text communications.
- Article 20 (governance). Management bodies must approve the cybersecurity measures, oversee their implementation and follow training. They can be held liable for infringements.
- Article 23 (incident reporting). A significant incident triggers an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
What this means in Romania
Romania transposed NIS2 through Government Emergency Ordinance (GEO) 155/2024, in force since 31 December 2024 and approved with amendments by Law 124/2025. The National Cyber Security Directorate (DNSC) is the competent authority. DNSC Orders 1/2025 and 2/2025, in force since 20 August 2025, set out registration and the risk-level self-assessment.
After registration, covered entities move through a sequence: risk-level assessment, a maturity self-assessment of their security measures, then a remediation plan submitted to DNSC. That maturity assessment is where unmanaged AV usually surfaces. Law 124/2025 also requires regular cybersecurity training for all staff and the appointment of persons responsible for network and information systems security.
The sectors in scope include public administration, energy, transport, banking, health, water and digital infrastructure, as well as manufacturing, research and digital providers. Public administration is also the most targeted sector in the EU: 38.2% of the 4,875 incidents ENISA analysed between July 2024 and June 2025.
Where AV creates cyber risk
Modern AV is IT. Most devices run an embedded operating system, expose web or SSH management interfaces, receive firmware updates and often connect to a vendor cloud. Many are installed by AV teams, managed outside IT and left unchanged for years.
System | Typical exposure | Why it matters |
|---|---|---|
Video bars, codecs and room PCs | Default admin passwords, outdated firmware, open management ports | Camera and microphone access in rooms where confidential decisions are taken |
Wireless presentation and BYOD gateways | Bridge guest devices to the corporate network | A path from an unmanaged laptop into internal VLANs |
Control processors and touch panels | Legacy protocols (Telnet, unencrypted HTTP), shared service accounts | Control of the whole room or building systems |
AV-over-IP and Dante audio networks | Multicast traffic on shared switches, no segmentation | Network performance and availability, eavesdropping on audio streams |
Video wall controllers and KVM in control rooms | Direct links to operational systems, 24/7 uptime that discourages patching | Integrity and availability of what operators see and act on |
Digital signage players and CMS | Internet-facing content management, weak update discipline | Content tampering and a public, reputational incident |
Cloud device management portals | Admin accounts without MFA, unrestricted vendor remote access | One compromised login exposes every room at once |
The weakness is rarely exotic. ENISA reports that phishing was the initial intrusion vector in around 60% of the cases it analysed, and vulnerability exploitation in 21.3%. An unpatched room device with a reachable management interface fits squarely into the second category.
NIS2 measures mapped to AV systems
NIS2 Article 21(2) measure | What it means for meeting and control rooms |
|---|---|
(a) Risk analysis and security policies | Include AV in the risk register and security policy, not as a separate facilities topic |
(b) Incident handling | Define who detects, isolates and reports an incident on an AV device, and how fast |
(c) Business continuity and crisis management | Fallback modes for control rooms and critical meeting spaces, configuration backups for every device |
(d) Supply chain security | Security requirements for AV manufacturers, integrators and maintenance providers in contracts and SLAs |
(e) Secure acquisition and maintenance | Security criteria in tenders, a firmware and patch policy, vulnerability handling |
(f) Assessing effectiveness | Periodic configuration audits and vulnerability scans that cover AV VLANs |
(g) Cyber hygiene and training | Training for AV technicians and room support staff, not only office users |
(h) Cryptography | Encrypted control and management traffic (HTTPS, SSH, TLS), encrypted calls and streams |
(i) Access control and asset management | A complete AV asset inventory, named admin accounts, removal of default credentials |
(j) MFA and secured communications | MFA on cloud management portals; secured video and voice platforms for sensitive meetings |
Meeting rooms and control rooms: different priorities
In meeting rooms, the main risks are confidentiality and scale. Dozens or hundreds of identical rooms share the same configuration, so one weakness repeats everywhere. Central device management, standard hardened configurations and cloud portal security deliver the biggest reduction in risk.
In control rooms, availability and integrity come first. Operators rely on the video wall and KVM chain to see and act on live operational data. Patching must be planned around 24/7 operations, the AV network should be isolated from both corporate and operational networks, and every change needs a tested rollback.
Procurement is also changing. Under the EU Cyber Resilience Act (Regulation 2024/2847), manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from 11 September 2026, and most other obligations apply from 11 December 2027. Asking for this in tenders now makes future upgrades simpler.
How ELTEK Integrate helps
ELTEK Integrate designs and integrates AV and IT as one system, so security is part of the design rather than an afterthought. For organisations preparing for NIS2, our teams can support:
- AV security assessment: an inventory of meeting room and control room devices, firmware and support status, and a gap list mapped to NIS2 measures [TO CONFIRM: offered as a defined service].
- Secure design and integration: network segmentation for AV, AV-over-IP and Dante, hardened device configurations and encrypted management, aligned with your IT security policy.
- Commissioning and documentation: as-built documentation, credential handover and configuration backups that support your audits.
- Maintenance and managed services: planned firmware updates, controlled remote access and 24/7 technical support with national coverage through our Customer Service Division.
- Training: handover sessions for IT and room support teams on secure operation of the installed systems.
Frequently Asked Questions
Does NIS2 apply to audio-visual equipment?
NIS2 applies to the network and information systems of covered entities, without listing device types. Networked AV equipment such as codecs, control systems and video wall controllers is part of those systems, so it falls under the risk-management measures.
Which organisations in Romania are covered by NIS2?
Entities in the sectors listed in the annexes to GEO 155/2024 that meet the size criteria, plus certain entities designated regardless of size. These include public administration, energy, transport, banking, health, water, digital infrastructure, manufacturing and digital providers. Each entity self-assesses and registers with DNSC.
What are the incident reporting deadlines under NIS2?
An early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month of the notification.
What is the first step to secure meeting room technology?
Build a complete inventory of every AV device on the network, with firmware version and support status. Segmentation, credential management and patching all depend on knowing what you have.
Should AV be on a separate network?
In most cases, yes. Dedicated AV VLANs with firewall rules limit what a compromised device can reach and protect AV performance. Control rooms usually need stricter isolation from both corporate and operational networks.
Need Additional Information?
If you require additional technical details or project‑specific information, our team is available to provide clarification and guidance.
