Documentation for Legal and Compliance Departments
1. Introduction
With the implementation of the NIS2 Directive and related national cybersecurity regulations, disaster recovery and data protection infrastructure must meet specific regulatory requirements. This document outlines how StateWarden's architecture aligns with compliance standards for data protection and business continuity.
2. Management Liability under NIS2
The NIS2 Directive emphasizes management responsibility in cybersecurity. Article 20 requires the management bodies of covered entities to approve cybersecurity risk-management measures, oversee their implementation, and be held accountable for non-compliance; Article 32 defines the minimum set of risk-management measures those entities must implement. StateWarden provides a documented, auditable infrastructure to support these risk management obligations.
3. Jurisdictional Scope
StateWarden is developed by an EU-based entity, utilizing infrastructure located within the European Union.
- Jurisdiction: Data processed within StateWarden is subject to EU law. The architecture is designed to avoid dependencies that would subject the data to foreign data access laws (e.g., the US CLOUD Act).
- GDPR Alignment: The system implements "Privacy by Design" through Zero-Knowledge encryption. Decryption keys remain within the client's infrastructure, ensuring that the service provider cannot access the plaintext data.
4. Infrastructure and Certification (OVHcloud)
StateWarden's Data Plane utilizes bare-metal servers hosted in European data centers operated by OVHcloud. The following certifications are held by OVHcloud as the infrastructure provider and cover its facilities and services:
- ISO/IEC 27001 (Information Security Management) and ISO/IEC 27701 (Privacy Management).
- SOC 1 Type II, SOC 2 Type II, and SOC 3
- HDS / SecNumCloud - Certifications for processing sensitive health data and general cloud security in specific EU jurisdictions.
These certifications are not held by StateWarden itself; StateWarden is separately pursuing its own certifications. Utilizing a certified infrastructure provider assists organizations in meeting the physical security requirements of their own compliance audits.
5. NIS2 Requirement Mapping
| NIS2 Subject Area | StateWarden Implementation |
|---|---|
| Supply Chain Security | Core software components are developed internally in the EU. Dependencies are actively audited and pinned. |
| Cryptography | Implementation of Zero-Knowledge encryption utilizing AES-256-GCM and post-quantum algorithms (ML-KEM). |
| Business Continuity | Bare Metal Recovery (BMR) capabilities provide mechanisms for restoring operational status following an incident. |
6. Summary
StateWarden provides an infrastructure designed to assist organizations in meeting the technical requirements of the NIS2 Directive and GDPR. The combination of local encryption, EU-based hosting, and comprehensive disaster recovery features supports organizational compliance strategies.