A prospect recently asked us a reasonable question:
"We already have MFA. Why would we need another trust mechanism?"
Multi-factor authentication is important. It helps establish that a person attempting to access a system is authorized.
But machines operate differently.
A server, gateway, controller or application can establish a trusted relationship and continue operating for months or years.
During that time, hardware gets serviced. Firmware is updated. Components are replaced. Software changes.
In a colocation facility, multiple organizations may have legitimate access to infrastructure. These are normal operational realities.
The question is not simply whether a system authenticated correctly when its relationship began.
Is the machine operating right now still the machine you intended to trust?
That question is becoming increasingly relevant to data centre cybersecurity regulation.
NIS2 is asking more of infrastructure operators
The European Union's NIS2 framework already places significant cybersecurity risk-management obligations on relevant digital infrastructure providers.
Commission Implementing Regulation (EU) 2024/2690 specifically covers data centre service providers.
Among its requirements are controls addressing asset management, physical and logical access, supplier risk, identity management, authentication and the integrity of network and information systems.
It also provides for multi-factor authentication or continuous authentication mechanisms for user access, where appropriate.
This is not a mandate for Continuous Proof Trust. Nor is its reference to continuous authentication specifically a requirement to adopt Iothic's machine-trust architecture.
But the regulatory direction is significant.
Infrastructure operators are increasingly expected to demonstrate that essential systems and services remain secure throughout their operational lives.
Physical access can change what you should trust
The EU regulation recognizes that compromised physical access to a data centre can constitute a significant incident.
Consider what happens after someone enters an equipment room without authorization.
Was a component replaced?
Was firmware altered?
Was a network appliance substituted?
Could an unauthorized device now be presenting credentials associated with an approved participant?
Physical security monitoring can identify entry into a restricted area. Asset management can record what equipment is supposed to be installed. Authentication systems can establish whether presented authentication material is recognized.
Each control matters.
But none necessarily establishes that the machine currently operating has maintained the provenance expected of the original participant.
At Iothic, provenance means:
Proof of origin and unbroken history that something is what it claims to be and hasn't been changed or substituted since last verified.
That is a different assurance question from whether a login or certificate was accepted.
DORA brings major infrastructure providers into direct oversight
The EU's Digital Operational Resilience Act (DORA) reinforces the importance of operational assurance across financial-sector technology dependencies.
On November 18, 2025, the European Supervisory Authorities published their first list of designated critical ICT third-party service providers.
The list includes Equinix (EMEA) B.V. and InterXion HeadQuarters B.V., associated with Digital Realty.
These designations bring critical providers within a dedicated European oversight framework.
Now consider an ordinary maintenance event.
A network appliance has operated inside a critical environment for two years. It was procured, provisioned and authenticated correctly.
Then it fails and must be replaced.
There may be nothing malicious about the replacement. But the participant has changed.
Should a new appliance automatically inherit the trust of the old one because it occupies the same rack position, uses the same network address or possesses recognized authentication material?
From a provenance perspective, that deserves a fresh determination.
The UK is moving in a similar direction
The UK's Cyber Security and Resilience (Network and Information Systems) Bill proposes bringing qualifying data centres into the country's essential-services cybersecurity framework.
The proposed regime recognizes the importance of data infrastructure to healthcare, financial services, public services and the wider economy.
As of October 29, 2026, the Bill has completed report stage in the House of Lords, with third reading scheduled for November 2. It has not yet received Royal Assent.
The Bill would introduce additional security, resilience and incident-reporting requirements for data centre operators within scope.
Again, the legislation does not prescribe Continuous Proof Trust.
What it illustrates is the increasing importance placed on the ongoing security of critical infrastructure, rather than relying exclusively on controls established at deployment or at the last audit.
Where Continuous Proof Trust fits
Continuous Proof Trust (CPT) addresses a specific architectural challenge: maintaining confidence in communicating participants beyond an initial authentication event.
With Iothic's kin technology, participating machines use fresh, relationship-bound evidence to support ongoing trust.
kin's authentication process operates without storing, exchanging or managing reusable authentication artifacts.
This removes the reusable authentication credential theft target from kin's own authentication mechanism.
It does not eliminate credentials used elsewhere in an organization's infrastructure, nor does it replace every cryptographic mechanism required for secure provisioning and communications.
The key distinction is that trust need not depend exclusively on continued possession of an authentication artifact that was accepted previously.
The machine must continue to provide evidence that it remains the expected participant in the relationship.
Maintenance should not break security — or bypass it
Hardware will always need replacement. Software will always require updates.
Continuous Proof Trust is not intended to prevent legitimate change.
It provides a mechanism through which the provenance of a changed participant can be evaluated and confidence renewed under the organization's defined policies.
Where relevant evidence no longer matches expectations, the operator can determine whether the relationship should continue, be restricted, be suspended or be terminated.
This supports a more deliberate distinction between authorized maintenance and unexpected substitution.
It can also complement an operator's existing asset inventory, identity management, physical access controls and security monitoring.
The emerging infrastructure assurance question
Data centre regulation is evolving through different mechanisms.
NIS2 addresses cybersecurity controls and significant incidents.
DORA establishes oversight of critical technology providers supporting financial institutions.
The UK's proposed reforms would extend resilience requirements to more critical data infrastructure.
None mandates CPT, and none should be presented as proof of compliance through any single product.
But they converge around an important operational concern:
How do you know that what you're trusting right now is still what you intended to trust?
For infrastructure operators, cloud providers, colocation facilities and organizations supporting critical services, that is a question worth asking.
Continuous Proof Trust offers an architectural approach to answering it.
If you're evaluating machine provenance, infrastructure resilience or continuously verified trust in your data centre environment, we'd welcome a technical discussion.