NIS2 and DORA.
Your provider is part of your risk.
Both rules hold you responsible for the cloud you build on. Here is what they ask of a provider, and where enum fits.
What the rules ask.
And how enum answers.
Manage the risk of your ICT third parties (DORA)
A German company, no US parent, contracts under German law
Secure your supply chain, including cloud (NIS2)
Infrastructure, network (AS215998) and platform operated by enum itself
Keep data where foreign authorities cannot compel access
Data in Frankfurt; the US CLOUD Act does not apply to enum
Have a credible exit plan
Upstream Kubernetes and the S3 API: workloads and data can move
Region is not jurisdiction.
The company holding the data decides.
An EU region at a US provider still belongs to a US company. The CLOUD Act follows the company, not the data center.
What enum brings.
Properties, not promises.
German company
enum GmbH, registered in Cologne, operating under German and EU law, with no US entity in its structure.
Data in Frankfurt
Workloads and data run in Frankfurt on infrastructure enum operates itself.
Own network
AS215998, registered with RIPE NCC, with its own address space and peering.
Highly available control plane
Every Kubernetes cluster gets a highly available control plane, included.
Upstream Kubernetes
No fork and no proprietary layer, so the exit plan DORA expects is realistic.
S3-compatible storage
Standard tools read and write your data, today and when you move.
What stays with you.
No provider can take this off your plate.
- Your risk assessment and your register of ICT providers
- Incident classification and reporting to the authorities
- Your own access, change and security policies
- Testing your resilience and your exit plan
Our Consulting team helps with the infrastructure side in a readiness assessment. Readiness assessment
Certifications.
Where we stand.
Questions.
About NIS2 and DORA.
Does NIS2 require an EU-based cloud provider?
Not explicitly. It makes you responsible for the security of your supply chain, including cloud. A provider under the US CLOUD Act adds a jurisdictional risk you cannot fully control; a German provider like enum removes it.
Is enum DORA-compliant?
DORA does not certify products; it puts obligations on financial entities and their ICT providers. enum gives you a provider you can build a DORA-compliant setup on: German company, data in Frankfurt, an exit path through open standards.
What is the difference between an EU region and an EU provider?
An EU region is a data center location. An EU provider is a company under EU law. The CLOUD Act applies to the company, so a US company's EU region is still covered by it.
How does enum help with DORA exit planning?
enum runs upstream Kubernetes and the standard S3 API, so manifests, Helm charts and data can move to another provider with standard tools.
Which certifications does enum have?
The Frankfurt data center is certified to ISO 27001 and EN 50600; those certificates belong to the facility operator. enum's own ISO 27001 certification is in progress, with a target of Q4 2026, and BSI C5 is on the roadmap for 2027.
Preparing for NIS2 or DORA?
Start with your infrastructure.
We answer the provider questions in your risk review, and our Consulting team assesses your infrastructure side.