Who Owns NIS2 and DORA on a Kubernetes Platform Team
CNCF, Friday, October 9th, 2026
Treating NIS2/DORA as security tickets stalls compliance; platform teams must own evidence-producing artifacts.
Many European engineering organizations route NIS2 and DORA requirements to the security team as tickets, creating bottlenecks, shadow infrastructure and platform engineers who never own the reasoning behind controls.
The author calls this an ownership failure, noting that security can write the policy but cannot merge the Helm chart.
The post traces requirements to Kubernetes objects, proposes a RACI that works with sprint planning and identifies CNCF projects that produce compliance evidence, while noting it is not legal advice.