If you fall under NIS2 or are getting ISO 27001 certified, you have to show who may do what, who did what and how data comes back. Clusterward enforces these rules in Kubernetes operations and records every change – you export the evidence instead of hunting it down.
Art. 21 of NIS2 requires technical and organizational measures, including access control, multi-factor authentication, encryption, backups and incident handling. Clusterward implements the technical parts for running your applications on Scaleway and logs them. That does not automatically make a company NIS2-compliant – risk analysis, reporting channels and training remain your responsibility – but it makes your Kubernetes operations auditable.
Set up roles, application scope, IP allowlist and alerts once.
Deployments, databases and access run through the cockpit or API tokens.
Every change lands in the audit log; secrets never in plain text.
Filter the audit log or export the entire configuration as a file.
Not as a year-end report, but as a property of every action in the cockpit.
Every user signs in with a password and a TOTP code, without exception. After failed attempts the account is locked, and sign-ins are rate-limited per address.
Roles define per area whether someone may view, operate or manage, and on which applications. An auditor role reads the audit log without being able to change anything.
Every change with the time, the person or API token and the affected object – filterable by person, action and time range. Secret values never appear in it. Every read-only look into a database through the SQL console is in it too.
Credentials and secrets are stored AES-256-GCM encrypted and are never displayed again after saving. Every host gets a TLS certificate.
Automatic database snapshots, backups of individual databases, volume snapshots and a return to any earlier version – with confirmation and a log entry.
Failed deployments, stuck pods, expiring certificates and changed secrets report in via webhook, Slack, Teams or email.
Guidance, not legal advice: the measures from Art. 21(2) and where operations help.
| Measure | What Clusterward contributes | Stays with you |
|---|---|---|
| Access control | Roles, application scope, IP allowlist | Who gets which role |
| Multi-factor authentication | TOTP for every user, without exception | Employees’ devices |
| Cryptography | Encrypted secrets, TLS for every host | Encryption within the application |
| Business continuity | Snapshots, backups, earlier versions, export | Emergency plan and recovery tests |
| Incident handling | Alerts and audit log as a trail | Reporting to authorities and customers |
| Vulnerabilities and maintenance | Kubernetes and add-on updates, hardened pods | Dependencies in your own code |
| Supply chain | EU provider, your own Scaleway project, your own registry | Assessing your service providers |
Roles, mandatory 2FA, IP allowlist and API tokens are described in Security & access. How databases and volumes come back is covered under Backups & recovery.
Which events raise an alert, and where it goes, is shown under Notifications. Why an EU location matters for your supply chain is explained in Digital sovereignty.
Which questions an auditor asks and which evidence holds up is shown in NIS2 in Kubernetes operations; why Kubernetes Secrets alone are not enough, in Kubernetes Secrets: why Base64 is not encryption.
Roles, mandatory 2FA, audit log and IP allowlist.
Go to Security & accessBring back databases, volumes and earlier versions.
Go to Backups & recoveryWebhook, Slack, Teams or email – once per event.
Go to NotificationsCan’t find your question? Write to us – we usually reply on the same business day.
Ask a questionBring your checklist: we show roles, 2FA, audit log, backups and export on a running environment.
