The trigger was a formal audit finding, not a strategic initiative. A mid-sized Nordic energy utility operating real-time grid-management systems received a pre-audit assessment from its national competent authority indicating that its current cloud architecture would not satisfy NIS2’s requirements for essential service operators. The sticking point was concrete: SCADA telemetry from live grid assets was being processed on infrastructure operated by a US-headquartered hyperscaler, subject to US jurisdiction and the reach of US federal law. The organisation had roughly four months to demonstrate a credible remediation path before the formal audit window opened.
NIS2 tightens the obligations on essential service operators across energy, transport, water, and several other sectors, and it does so with teeth. For a grid operator, the relevant pressure points are security of network and information systems, incident reporting obligations, and, critically, supply chain risk. Routing live operational technology data through a provider that can be compelled by a foreign government to disclose or intercept that data is not a theoretical risk under the directive: it is an architectural deficiency that auditors are trained to identify. The utility’s legal and compliance team had flagged the jurisdictional exposure before, but the cost and complexity of migration had kept it on the backlog. The audit finding moved it to the top of the agenda overnight.
The technical challenge was not trivial. The existing pipeline ingested telemetry from substations and distribution assets at sub-second intervals, processed it through a stream-processing layer for anomaly detection and load forecasting, and wrote results to a time-series store consumed by the grid operations centre. Latency tolerance was tight: the operations team needed processed data within two seconds of ingestion. Any migration architecture had to preserve that latency budget while moving every component to infrastructure that was unambiguously within EU jurisdiction and subject solely to European law.
Architecture: bare metal, event streaming, and a clean jurisdictional boundary
DIVERSITY’s engagement began with a four-week architecture review. The HEL1 Helsinki datacenter was the natural anchor for the workload: geographically close to the utility’s grid assets in the Nordic region, powered by 100% renewable energy (relevant to the organisation’s own sustainability reporting), and operating under Finnish and EU law with no foreign parent company in the ownership chain. A secondary footprint at MUC1 Munich provided the disaster recovery leg, with EU-only replication ensuring that data never left European jurisdiction even in a failover scenario.
The core of the new architecture was a bare metal event streaming cluster running at HEL1, replacing the managed Kafka service the utility had been using on its previous provider. DIVERSITY’s event streaming infrastructure is Kafka-compatible, meaning the utility’s existing producers and consumers required only endpoint reconfiguration rather than code rewrites. That compatibility decision cut weeks from the migration timeline. The stream-processing layer, a set of stateful operators performing windowed aggregations for anomaly scoring, was redeployed onto dedicated bare metal nodes rather than shared virtual infrastructure. Bare metal eliminated the noisy-neighbour latency variance that had occasionally caused the utility to breach its two-second processing budget on the previous platform.
The time-series store was migrated to DIVERSITY’s block storage-backed infrastructure, with snapshots replicated to MUC1 on a fifteen-minute cycle. BGP multihoming across both sites meant that a datacenter-level event would trigger automatic traffic failover without manual intervention, satisfying the resilience requirements that NIS2 places on operators of essential services. The utility’s security operations team integrated with DIVERSITY’s SecOps SOC monitoring service, giving them continuous visibility into the infrastructure layer and a documented incident response chain that could be presented directly to auditors.
Sovereignty as an engineering requirement, not a checkbox
One of the more demanding parts of the engagement was producing the documentation trail that auditors would need. NIS2 compliance in the energy sector is not satisfied by a vendor’s self-attestation: the organisation needs to demonstrate that its supply chain is auditable, that its data processing agreements are governed by EU law, and that there is no contractual or legal mechanism by which a foreign authority could access operational data without the knowledge and consent of the relevant EU member state authorities.
Sovereignty in critical infrastructure is not a marketing claim you can buy from a hyperscaler’s compliance page. It is a legal and architectural property that has to be engineered into the stack from the ground up.
DIVERSITY’s status as a European-headquartered company with no US parent, combined with ISO 27001 certification and a contractual 99.9% uptime SLA, gave the utility’s legal team the foundations they needed. The data processing agreements were drafted under EU law, the sub-processor list contained no entities subject to foreign jurisdiction, and the physical infrastructure was documented to Tier III standards at both HEL1 and MUC1. DIVERSITY’s team worked directly with the utility’s compliance officers to prepare the evidence package, mapping each NIS2 obligation to a specific architectural or contractual control.
Outcome: a clean audit and a leaner cost structure
The formal NIS2 audit took place approximately six months after the migration project kicked off. The utility passed without a single remediation finding related to its cloud infrastructure. The auditors noted the jurisdictional clarity of the new architecture, the documented incident response chain, and the resilience design across two geographically separate EU datacenters as positive indicators of maturity.
The financial outcome was an unexpected benefit rather than a primary objective, but it was significant. By eliminating cross-region egress charges from its previous provider and consolidating onto bare metal capacity with predictable monthly pricing, the utility reduced its annual cloud spend by approximately 30 percent. The savings were not the result of cutting capability: the new architecture handled higher throughput with lower latency than the previous setup. They were the result of moving from a consumption model designed around hyperscaler margin structures to dedicated infrastructure priced for sustained, predictable workloads.
The utility’s operations team also reported a measurable improvement in pipeline latency consistency. Bare metal removed the scheduling jitter that had occasionally pushed processing times above the two-second threshold. In a grid operations context, that consistency is not a comfort metric: it directly affects the quality of the anomaly detection models that inform real-time switching decisions.
What this engagement demonstrates
NIS2 is creating a forcing function across European critical infrastructure that procurement teams and cloud architects cannot defer. For energy operators specifically, the combination of OT pipeline data sovereignty requirements, supply chain risk obligations, and the sector’s existing regulatory density means that jurisdictional exposure in cloud architecture is now an audit risk, not just a policy preference. The path through that risk is not complexity: it is choosing infrastructure that is unambiguously European by ownership, law, and physical location, and building the documentation to prove it.
- Bare metal event streaming at HEL1 replaced a managed Kafka service, with full Kafka API compatibility preserving existing producer and consumer code
- Dual-site EU-only replication across HEL1 and MUC1 satisfied NIS2 resilience requirements without data leaving European jurisdiction
- SecOps SOC integration provided the documented incident response chain auditors required
- Annual cloud spend fell by roughly 30 percent through elimination of egress charges and consolidation onto predictable bare metal pricing
- Pipeline latency consistency improved, removing occasional breaches of the two-second operational threshold
