If you fall under NIS2 or are getting ISO 27001 certified, you have to show who may do what, who did what and how data comes back. Clusterward enforces these rules in Kubernetes operations and records every change – you export the evidence instead of hunting it down.
Art. 21 of NIS2 requires technical and organizational measures, including access control, multi-factor authentication, encryption, backups and incident handling. Clusterward implements the technical parts for running your applications on Scaleway and logs them. That does not automatically make a company NIS2-compliant – risk analysis, reporting channels and training remain your responsibility – but it makes your Kubernetes operations auditable.
Set up roles, application scope, IP allowlist and alerts once.
Deployments, databases and access run through the cockpit or API tokens.
Every change lands in the audit log; secrets never in plain text.
Filter the audit log or export the entire configuration as a file.
Not as a year-end report, but as a property of every action in the cockpit.
Every user signs in with a password and a TOTP code, without exception. After failed attempts the account is locked, and sign-ins are rate-limited per address.
Roles define per area whether someone may view, operate or manage, and on which applications. An auditor role reads the audit log without being able to change anything. A signed access review on a fixed cycle shows that access is still right.
Every change with the time, the person or API token and the affected object – filterable by person, action and time range. Secret values never appear in it. Every look into a database through the SQL console is in it too, and every change with its preview. Entries are kept for 12 months; after that Clusterward deletes them automatically. Every call of an AI assistant is in it too – under the token or the person who connected it. So is every look at a database password.
Credentials and secrets are stored AES-256-GCM encrypted and are never displayed again after saving. Every host gets a TLS certificate.
Automatic database snapshots, backups of individual databases, volume snapshots and a return to any earlier version – with confirmation and a log entry. Clusterward backs up buckets every night with Object Lock and tests the restore monthly.
Failed deployments, stuck pods, expiring certificates and changed secrets report in via webhook, Slack, Teams or email.
Guidance, not legal advice: the measures from Art. 21(2) and where operations help.
| Measure | What Clusterward contributes | Stays with you |
|---|---|---|
| Access control | Roles, application scope, IP allowlist and a signed access review | Who gets which role |
| Multi-factor authentication | TOTP for every user, without exception | Employees’ devices |
| Cryptography | Encrypted secrets, TLS for every host | Encryption within the application |
| Business continuity | Snapshots, backups, S3 backups with Object Lock and restore tests, earlier versions, export | Emergency plan and recovery tests |
| Incident handling | Alerts and audit log as a trail | Reporting to authorities and customers |
| Vulnerabilities and maintenance | Kubernetes and add-on updates, hardened pods | Dependencies in your own code |
| Supply chain | EU provider, your own Scaleway project, your own registry | Assessing your service providers |
Roles, mandatory 2FA, IP allowlist and API tokens are described in Security & access. How databases and volumes come back is covered under Backups & recovery.
Which events raise an alert, and where it goes, is shown under Notifications. Why an EU location matters for your supply chain is explained in Digital sovereignty.
Which questions an auditor asks and which evidence holds up is shown in NIS2 in Kubernetes operations; why Kubernetes Secrets alone are not enough, in Kubernetes Secrets: why Base64 is not encryption.
All the evidence on one page – live checks with their Annex A control, reports as CSV, the signed access review and the compliance pack – is on the compliance page. How buckets are backed up and locked every night and tested monthly is shown under S3 backups.
Roles, mandatory 2FA, audit log and IP allowlist.
Go to Security & accessBring back databases, volumes and earlier versions.
Go to Backups & recoveryLive checks with their Annex A control, reports and the compliance pack.
Go to the compliance pageNo, no software can do that. NIS2 also requires risk analysis, policies, training and reporting channels. Clusterward implements the technical measures for running your applications on Scaleway and provides the evidence for them – an important, auditable part, but not the whole.
Can’t find your question? Write to us – we usually reply on the same business day.
Ask a questionBring your checklist: we show roles, 2FA, audit log, backups and export on a running environment.
