[On-Demand Webinar] Fractal Sprint: Automation, Security and Multi-Cloud in One Platform | Watch Now →

Fractal Cloud
Blog
Simplifying NIS2 compliance in multi-cloud environments through standardized infrastructure and automation

NIS2 and Cloud: how to simplify compliance without slowing down development

Introduction

🔹 Executive takeawayNIS2 compliance is a matter of operational scale, not just regulation.Manual approaches are not sustainable in multi-cloud environments.Standardizing infrastructure is the most effective way to reduce risk and complexity.Embedding compliance into the platform allows you to accelerate without losing control.The NIS2 directive introduces new cybersecurity requirements for European organizations.The problem in 2026 is not understanding them.It’s implementing them in complex cloud environments without increasing operational complexity or slowing down development.Fractal Cloud addresses this challenge by integrating security, governance, and automation directly into the infrastructure.

What is the NIS2 Directive

NIS2 is the European regulation that updates the previous NIS1 directive, introducing stricter cybersecurity requirements.It includes:🔷 more detailed risk management obligations🔷 higher security requirements🔷 stricter penalties for non-complianceThe goal is to create a uniform level of security across organizations operating within the European Union.

Which companies must comply with NIS2

The directive applies to a broader range of organizations compared to the past.It includes:🔷 medium and large enterprises🔷 organizations in critical sectors🔷 digital service providers, including cloud providersKey sectors include:🔷 energy🔷 healthcare🔷 transport🔷 finance🔷 digital infrastructure🔷 public administrationNIS2 compliance therefore becomes an operational priority, not just a regulatory one.

The challenges of NIS2 in the cloud

Adapting to NIS2 in cloud environments introduces specific complexities.1. Multi-cloud environmentsMany organizations operate across multiple providers.Maintaining consistent security standards becomes difficult.2. Shared responsibilityIn the cloud, security is shared between provider and customer.This creates ambiguity around ownership and controls.3. Lack of specialized skillsAdvanced expertise in security and infrastructure is required.Not always available internally.The result is often the same:🔷 configuration errors🔷 complex audits🔷 increased operational riskFor management, this translates into higher exposure to risk and difficulty in continuously demonstrating compliance.The real limitation, however, is not the regulation.It’s how it is implemented.In most organizations, compliance is still managed as a layer separate from infrastructure.This approach does not scale.

Why traditional IaC is not enough

Infrastructure as Code tools enable repeatable infrastructure provisioning.However, they mainly focus on the provisioning phase.They do not guarantee that:🔷 configurations remain compliant over time🔷 manual changes are detected🔷 environments stay aligned with defined standardsThis means compliance must be verified separately, through audits or periodic checks.The limitation is not just technical, it’s a model issue.Infrastructure as Code treats infrastructure as code to be executed.In this approach, infrastructure is a system governed over time, where the desired state is defined, maintained, and continuously enforced.It’s not just about creating environments correctly.It’s about ensuring they remain compliant over time.

Drift and loss of compliance over time

One of the main issues in cloud environments is configuration drift.Even when infrastructure is initially compliant, subsequent changes can introduce deviations from defined standards.These changes may include:🔷 manual interventions🔷 uncontrolled updates🔷 inconsistencies across environmentsThe result is a gradual loss of compliance, often difficult to detect without continuous monitoring.The key point is that compliance is not verified after the fact.It is maintained over time.This continuous compliance approach reduces dependency on periodic audits and makes compliance an active property of infrastructure, not a separate activity.

How Fractal Cloud simplifies NIS2 compliance

Fractal Cloud is a platform engineering solution that enables secure and compliant infrastructure through standardization.Instead of managing compliance manually, it embeds it directly into provisioning and operations.Blueprints with built-in securityBlueprints are not just templates.They define a complete desired state of infrastructure, including configurations, policies, and operational constraints.With Fractal Cloud:🔷 security controls are part of infrastructure definition🔷 every environment is created from these rules🔷 uncontrolled variations are preventedEach environment derives from versioned definitions, making it immediately verifiable and aligned with standards.Lifecycle automation and governanceThe Fractal Automation Engine goes beyond provisioning automation.It governs the entire infrastructure lifecycle, ensuring that all changes occur through controlled operations.This means:🔷 no untracked manual changes🔷 every change aligns with defined policies🔷 operations are fully auditableThis directly supports NIS2 requirements for control, traceability, and ICT risk management.Drift management and continuous alignmentFractal Cloud keeps environments aligned with the defined Blueprint state.This means:🔷 deviations are detected🔷 environments can be realigned🔷 configurations do not drift over timeCompliance is not dependent on periodic checks, it is continuously maintained.Centralized governance across multi-cloudFractal Cloud applies consistent standards across:🔷 AWS🔷 Azure🔷 GCP🔷 OCI🔷 hybrid environmentsThis prevents fragmentation and reduces discrepancies that make audits complex.Reduced complexity for teamsDevelopers work with abstracted components instead of provider-specific details.This enables:🔷 elimination of uncontrolled manual configurations🔷 creation of compliant environments by default🔷 faster environment provisioning

Benefits for NIS2 compliance

With Fractal Cloud, compliance becomes part of the infrastructure.Key benefits:🔷 reduced manual audits🔷 less remediation effort🔷 verifiable configurations🔷 lower operational risk🔷 faster provisioning of compliant environments

Business impact

For organizations subject to NIS2, compliance management directly impacts:🔷 Operational risk: reduced exposure to uncontrolled changes.🔷 Costs: fewer manual audits and corrective actions.🔷 Delivery speed: ready-to-use, compliant environments.🔷 Governance: greater control over distributed infrastructure.NIS2 highlights a structural limitation of traditional cloud models:manually managed compliance does not scale.Organizations that continue separating compliance from infrastructure increase complexity and risk over time.Those that embed compliance into the platform can maintain continuous control, even in complex environments.Fractal Cloud enables this shift, transforming compliance from an operational burden into an intrinsic property of infrastructure.In today’s landscape, the ability to maintain and demonstrate compliance over time is no longer optional, it is an operational requirement.Build Faster, Run Anywhere.

Cut the Wait. Reduce the Cost.Keep Control.

Get StartedBook a Demo

More articles

How to align Dev and Ops: a question of operating model

How to align Dev and Ops: a question of operating model

Aligning infrastructure teams and development teams comes down, first of all, to the operating model. Tools matter, but on their own they explain little of what slows delivery down.Over the past few years almost every organization has tried to speed up delivery by adopting cloud, containers, and CI/CD pipelines. The outcome tends to repeat itself: developers want to move fast, while whoever runs the infrastructure has to guarantee security, compliance, and cost control. A structural conflict follows, where developers experience controls as a brake and Ops read team autonomy as a risk.There is a fairly precise way to measure that conflict: the cognitive load on developers, meaning how much they have to hold in their head before they can ship. When every team needs Kubernetes, Terraform, IAM policies, and the quirks of each provider, the time spent wiring infrastructure together is time taken from the product. Gartner estimates that by 2026, 80% of large software organizations will have a dedicated platform engineering team, up from 45% in 2022.The useful question, then, is how to design a system where speed and governance stop competing. It is the question Fractal Cloud was built around, and it deserves a general answer before a product one.

When Your Digital Twin Has Hands

When Your Digital Twin Has Hands

Closing the Loop Between Observability and InfrastructureMost organizations have good observability. They know within seconds when something breaks. And then someone gets paged.Alerts fire into runbooks, runbooks require humans, and humans are a bottleneck. The industry spent a decade solving the seeing problem. The acting problem is still largely manual.According to ITIC 2024 analysis, every minute of downtime costs a data center an average of $9,000. Speed and precision of response are not an operational detail: they are the factor that determines the final cost.There are two reasons this persists: operational data is fragmented across tool silos, so no single system has the full picture; and organizations don't trust automation they can't explain. Both problems need the same fix: a layer that contextualizes events across the full system, reasons deterministically about what to do, and executes infrastructure changes with full traceability.

Composable cloud architecture with modular infrastructure and governance components in Fractal Cloud

Composable Architecture: How to Build Platforms That Scale Without Multiplying Complexity

There's a pattern that appears in every infrastructure organization that has grown without a deliberate architectural philosophy.Twelve different Kubernetes configurations. Four different ways to define a database. Three different networking approaches. None of them wrong. None of them the same.The platform team spends more time understanding what's already running than building what should run next. New systems aren't built they're spawned from the nearest available precedent, carrying forward every quirk and accidental decision of whatever they were copied from.This post is about the architectural model that improves this cycle: composability. For platform engineers and architects who are tired of complexity accumulating faster than they can manage it.