NIS2 Doesn’t Require On-Premises Hosting: What the Directive Leaves European Buyers to Decide
Does NIS2 require on-premise credential management?
No. The directive does not require organizations to self-host their password or secrets manager, nor does it prescribe a cloud deployment.
Article 21 mandates appropriate and proportionate cybersecurity measures based on the organization’s risk exposure, the state of the art, and implementation costs. However, the Directive does not express any guidance on location, on-premises, or in the cloud.
NIS2 only focuses on whether you can enforce least-privilege access, use phishing-resistant MFA, and produce reliable audit logs during an incident or audit. So organizations have to choose a deployment model and be able to explain the risks they considered when making that decision.
Key insights
- NIS2 does not require on-premise credential management and does not prescribe cloud; Article 21 asks for appropriate and proportionate measures based on risk.
- A hosted password or secrets manager is a supplier under Article 21(2)(d), and an unusual one, because...
Copyright of this story solely belongs to cloudtweaks.com. To see the full text click HERE
