Skip to content

docs: add ENISA NIS2 reference to best practice intro #2020

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Xata wants to merge 2 commits into
base: master
Choose a base branch
from
Open

docs: add ENISA NIS2 reference to best practice intro #2020

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1a1d96f
docs: add ENISA NIS2 reference to best practice intro
Xata Mar 22, 2026
1f14da9
Merge branch 'master' into master
Xata Mar 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .spelling
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ ArgoCD
Arsh
ArtifactHUB
ArtifactHub
APP.4.4
AzureDNS
BasicConstraints
Bullseye
Expand Down Expand Up @@ -189,6 +190,7 @@ CryptoKey
csi-driver
csi-driver-spiffe
Ctrl
cybersecurity
DCO
DHCP
DNS01
Expand All @@ -214,6 +216,7 @@ EKS
ELB
Ed25519
Encrypter
ENISA
Fargate
FastDNS
FreeIPA
Expand All @@ -227,6 +230,7 @@ GKE
GitOps
github-actions
gRPC
Grundschutz
GSoC
Gloo
GoDaddy
Expand Down Expand Up @@ -281,6 +285,7 @@ Makefile
Makefiles
NameCheap
NGINX
NIS2
NLB
NLBs
NotIn
Expand Down Expand Up @@ -602,6 +607,7 @@ v1.18.0.
v1.19
v1.19.0
v1.19.1
v1.2
v1.20.0
v1.19.2
v1.20.0
Expand Down
28 changes: 19 additions & 9 deletions content/docs/installation/best-practice.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,27 @@ title: Best Practice
description: |
Learn about best practices for deploying cert-manager in production,
and how to configure cert-manager to comply with popular security standards
such as those produced by the CIS, NSA, and BSI.
such as those produced by the CIS, NSA, BSI, and ENISA.
---

In this section you will learn how to configure cert-manager to comply with popular security standards such as
the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/),
the [NSA Kubernetes Hardening Guide](https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF), or
the [BSI Kubernetes Security Recommendations](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf?__blob=publicationFile&v=2#page=475).

And you will learn about best practices for deploying cert-manager in production;
such as those enforced by tools like [Datree and its built in rules](https://hub.datree.io/built-in-rules),
and those documented by the likes of [LearnKube in their "Kubernetes production best practices" checklist](https://learnkube.com/production-best-practices/).
In this section you will learn how to configure cert-manager to comply with popular security standards
and hardening guidelines for Kubernetes. The recommendations in this guide are informed by the
following standards:

- [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/), published by the
Center for Internet Security, covering secure configuration of Kubernetes components including TLS,
RBAC, and network policies.
- [NSA/CISA Kubernetes Hardening Guide](https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF)
(v1.2, August 2022), joint guidance from the United States National Security Agency and CISA on hardening
Kubernetes clusters against supply chain, threat actor, and insider risks.
- [BSI IT-Grundschutz Compendium](https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf?__blob=publicationFile&v=2),
Germany's Federal Office for Information Security (BSI) baseline protection framework, including
module APP.4.4 for Kubernetes.
- [ENISA NIS2 Technical Implementation Guidance](https://www.enisa.europa.eu/publications/nis2-technical-implementation-guidance),
published by the EU Agency for Cybersecurity, providing practical guidance and standard mappings for
implementing the cybersecurity risk-management measures required by
[Commission Implementing Regulation (EU) 2024/2690](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2690)
under the [NIS2 Directive (EU 2022/2555)](https://eur-lex.europa.eu/eli/dir/2022/2555).

## Overview

Expand Down