{"id":73439,"date":"2026-05-12T14:58:05","date_gmt":"2026-05-12T12:58:05","guid":{"rendered":"https:\/\/www.schneider.im\/?p=73439"},"modified":"2026-05-12T14:58:05","modified_gmt":"2026-05-12T12:58:05","slug":"broadcom-vmware-vcf-meet-nis2-dora-and-data-sovereignty-requirements","status":"publish","type":"post","link":"https:\/\/www.schneider.im\/lu\/broadcom-vmware-vcf-meet-nis2-dora-and-data-sovereignty-requirements\/","title":{"rendered":"Broadcom VMware VCF: Meet NIS2, DORA, and Data Sovereignty Requirements"},"content":{"rendered":"

European regulators have\u00a0raised the bar<\/strong>\u00a0on cybersecurity and operational resilience. Organizations across the EU are now expected to\u00a0prove<\/strong>\u00a0that their IT environments are\u00a0secure, recoverable, and under their own legal control<\/strong>.\u00a0Complying with regulations such as the Digital Operational Resilience Act (DORA) has become an increasingly painstaking process. There are unclear definitions and demanding adherence requirements. Software that helps organizations meet these obligations has never been more critical.<\/p>\n

VMware Cloud Foundation (VCF) <\/strong>is the software that powers a company\u2019s\u00a0private datacenter<\/strong>. It provides the technical foundations that\u00a0IT professionals,<\/strong> compliance officers, auditors, and boards<\/strong>\u00a0need to\u00a0demonstrate\u00a0adherence to the\u00a0NIS2 Directive<\/strong>, DORA<\/strong> and\u00a0EU data sovereignty<\/strong>\u00a0expectations.<\/p>\n

This article explains, how\u00a0VCF <\/strong>helps EU organizations meet these obligations\u00a0without sacrificing modern capabilities<\/strong> such as AI, automation, and cloud-style operations.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Why EU regulatory compliance matters now<\/h2>\n

The regulatory landscape in Europe has\u00a0changed faster in the last two years<\/strong>\u00a0than in the\u00a0previous\u00a0decade. Several rules now apply\u00a0in parallel<\/strong>\u00a0and reinforce each other:<\/p>\n

    \n
  • NIS2 Directive.<\/strong>\u00a0The\u00a0EU cybersecurity\u00a0law<\/strong>\u00a0that\u00a0requires\u00a0critical and important organizations<\/strong>\u00a0to prove strong security, manage supply-chain risk, and\u00a0report serious incidents within 24 hours<\/strong>. Boards are now\u00a0personally accountable<\/strong>\u00a0for cybersecurity oversight.<\/li>\n<\/ul>\n
      \n
    • DORA (Digital Operational Resilience Act).<\/strong>\u00a0In force across the EU since\u00a0January 17, 2025<\/strong>, DORA requires\u00a0financial entities<\/strong>\u00a0(banks, insurers, investment firms, and many of their IT suppliers) to prove they can\u00a0withstand, respond to, and recover from Information and Communications Technology (ICT) incidents<\/strong>, including major cyberattacks.<\/li>\n<\/ul>\n
        \n
      • EU Data Act and sovereignty expectations.<\/strong>\u00a0Customers, regulators, and partners increasingly require that\u00a0sensitive data\u00a0stays\u00a0under EU legal\u00a0control<\/strong>\u00a0and that organizations are\u00a0not locked into a single non-EU provider<\/strong>.<\/li>\n<\/ul>\n
          \n
        • Audit pressure is constant.<\/strong>\u00a0Internal auditors, external auditors, and supervisory authorities now expect\u00a0documented evidence<\/strong>. This should cover access, encryption, segmentation, recovery testing, and incident response<\/strong>.<\/li>\n<\/ul>\n
            \n
          • High Penalties.<\/strong>\u00a0NIS2 and DORA both carry\u00a0significant administrative fines<\/strong>, and NIS2 allows action against\u00a0individual senior managers<\/strong>\u00a0for non-compliance.<\/li>\n<\/ul>\n

            Under these conditions, the way an organization\u00a0designs and runs its private datacenter<\/strong>\u00a0becomes a\u00a0central compliance question<\/strong>.<\/p>\n

             <\/p>\n

            How VCF supports EU regulatory requirements<\/h2>\n

            1) Sovereign control over data and encryption keys<\/h3>\n

            \"\"<\/p>\n

            VCF 9.1<\/strong>\u00a0runs in\u00a0your own datacenter<\/strong>, under your own legal entity, on hardware you control. This is the\u00a0strongest possible posture<\/strong>\u00a0for\u00a0data sovereignty<\/strong>\u00a0as it keeps data under the legal control of a specific country or region.<\/p>\n

            VCF 9.1 includes\u00a0native encryption<\/strong>\u00a0for stored data, virtual machines, and backups. The\u00a0encryption keys<\/strong>\u00a0are managed by a\u00a0KMS (Key Management Server)<\/strong>\u00a0which is the system that\u00a0stores and controls the keys<\/strong>\u00a0used to lock and unlock data.<\/p>\n

            How it helps you with regulators:<\/strong><\/p>\n