NIS2 Doesn’t Require On-Premises Hosting: What the Directive Leaves European Buyers to Decide
No. The directive does not require organizations to self-host their password or secrets manager, nor does it prescribe a cloud deployment. Article 21 mandates appropriate and proportionate cybersecurity measures based on the organization’s risk exposure, the state of the art, and implementation costs. However, the Directive does not express any guidance on location, on-premises, or in the cloud. NIS2 only focuses on whether you can enforce least-privilege access, use phishing-resistant MFA, and produce reliable audit logs during an incident or