The enforcement notice arrived before the operator had finished its internal NIS2 gap assessment. Italy’s national regulator had flagged the telecommunications company, which serves roughly four million subscribers, for insufficient territorial controls over real-time network event data. The immediate requirement was clear: demonstrate, with audit-ready documentation, that subscriber metadata processed in event streams never left EU jurisdiction. The operator had weeks, not quarters, to produce evidence.
The underlying architecture had evolved organically over several years. Event data from network probes, authentication events, session logs, and subscriber activity records was flowing into a managed streaming platform operated by a hyperscaler. The contract permitted failover to data centre regions outside the EU without explicit customer consent or notification, a standard clause that had seemed acceptable before NIS2 enforcement began in earnest. Under the directive’s requirements for critical communications infrastructure, that ambiguity was no longer tolerable. The regulator wanted a data flow map, a list of processing locations, and contractual proof of residency. The operator could not produce any of the three.
Compounding the compliance problem was a financial one. Egress costs on the hyperscaler platform had grown by thirty percent year-on-year as data volumes scaled with subscriber activity. The operator was paying to move its own subscribers’ data between regions it had not chosen and could not audit. Engineering teams had attempted to cap costs by throttling event throughput, which introduced latency into fraud detection and network fault correlation pipelines. Operational quality was degrading alongside regulatory standing.
Mapping the migration path
DIVERSITY’s engagement began with a two-week architecture review focused on three questions: which event streams carried subscriber metadata subject to NIS2 territorial obligations, what throughput and latency envelopes the downstream consumers required, and which processing locations would satisfy both the regulator’s jurisdiction requirements and the operator’s own redundancy targets. The answers shaped the migration design before a single workload moved.
The operator’s streaming pipeline was rebuilt on DIVERSITY’s EU-sovereign infrastructure, deployed across two sites to provide the geographic redundancy the operator’s internal SLAs required. The primary ingestion and processing layer ran on bare metal nodes at MAD1 in Madrid, chosen for its direct connectivity to the operator’s Italian network via established peering paths and its role as a Southern European hub. A secondary replication target at MUC1 in Munich provided failover capacity within the EU boundary, with BGP multihoming ensuring continuity if either site experienced a disruption. Both sites are ISO 27001 certified and subject exclusively to European law, with no foreign parent company capable of receiving a data disclosure order under non-EU jurisdiction.
The streaming layer itself was built on DIVERSITY’s Kafka-compatible event streaming platform, which allowed the operator’s existing producer and consumer applications to connect without rewriting client code. Internal schema registries, offset management, and consumer group configurations were migrated with tooling the DIVERSITY engineering team had developed across previous financial-sector migrations. The operator’s development teams ran parallel ingestion for a four-week validation period, comparing output between the legacy hyperscaler environment and the new sovereign infrastructure before cutover. Throughput targets were met from the first week of parallel operation; end-to-end latency on the fraud detection pipeline improved because the new routing eliminated cross-region hops the previous architecture had introduced silently.
Satisfying the regulator’s audit requirements
The audit package the operator needed to submit was not just a technical diagram. The regulator required contractual evidence of data residency, a list of all sub-processors with their processing locations, and a demonstration that no failover path could route subscriber data outside the EU without an explicit configuration change requiring customer authorisation. DIVERSITY’s contractual structure addressed each point directly.
Because DIVERSITY operates its own infrastructure and is not a reseller layering services on top of a hyperscaler, the sub-processor list was short and entirely EU-domiciled. The data flow map the operator submitted to the regulator identified two processing locations, both within the EU, both under a single contractual relationship governed by European law. The failover architecture between MAD1 and MUC1 was documented with network diagrams showing that no traffic path existed to regions outside the defined EU boundary without an explicit routing change that would require operator authorisation and generate an audit log entry.
Territorial certainty is not a configuration setting. It is a contractual and architectural property that has to be true by design, not enforced by monitoring after the fact.
The regulator reviewed the submission within the reporting cycle and closed the enforcement notice. No additional evidence requests were raised. The operator’s compliance team, which had been managing the notice as a live regulatory risk for several months, was able to close the item in its risk register and redirect attention to the broader NIS2 implementation programme.
Cost outcomes and operational gains
The financial impact of the migration exceeded the initial projection. Monthly streaming infrastructure spend fell by more than a quarter compared with the hyperscaler baseline, driven by the elimination of cross-region egress charges and the move to a predictable capacity model on dedicated infrastructure. Because the operator now controls its own retention and replication topology, it was able to right-size storage for each event category rather than accepting the default tiering the hyperscaler had applied.
The fraud detection and network fault correlation pipelines that had been throttled to manage egress costs were restored to full throughput. The latency improvement on the fraud pipeline, a reduction of several hundred milliseconds on the median processing path, was sufficient to re-enable a real-time intervention capability the operator had disabled eighteen months earlier because the previous architecture could not support it economically.
The operator has since extended the DIVERSITY engagement to include managed object storage for event archive retention and is evaluating DIVERSITY’s SecOps capabilities for SOC monitoring of the streaming infrastructure itself. NIS2 compliance, which began as an enforcement-driven obligation, has become the foundation for a broader consolidation of critical infrastructure onto sovereign EU cloud.
