CNCF discusses ownership of NIS2 and DORA compliance on Kubernetes platforms
Key Takeaway
Regulatory compliance on Kubernetes fails when regulations are treated as security tickets rather than engineering artifacts.
Summary
A CNCF blog post addresses the organizational failure of implementing NIS2 and DORA regulations within Kubernetes platform teams. It argues that compliance fails when security teams own the regulation name without owning the technical implementation. The article proposes a traceability chain that converts regulatory requirements into specific Kubernetes artifacts and sprint items owned by platform engineers.
Bridging the gap between regulation and Kubernetes
- Recommends moving from 'regulation-based tickets' to 'artifact-based sprint items'.
- Proposes a traceability chain: Risk/Legal/Security define the scope and control questions, while Platform/Application teams deliver the technical artifacts.
- Examples of required Kubernetes artifacts include:
- Hardened image catalogs and rebuild pipelines.
- Secrets management as the sole credential path.
- Kubernetes audit and ingress logs integrated with SIEM.
- Admission policies (e.g., restricted Pod Security Standards).
Why it matters
The post highlights how poor organizational design leads to shadow infrastructure and non-compliance in cloud-native environments.
Original reference: www.cncf.io →