Article · Sashree Seepersad · 20 October 2026
Landing zones under DORA, Swiss nDSG, and NIS2
A regulated estate does not get a separate compliance project at the end. Residency, keys, and privilege are part of the landing zone.
What goes in the design
- Residency. Swiss nDSG, and NIS2 and DORA where they apply, decide where the workload and the keys sit before the subscription pattern is copied.
- HYOK. Hold-your-own-key encryption keeps key control with the estate.
- Privilege. PIM just-in-time access, with no standing privilege. On the landing zones I run, a privileged session can be killed in under 30 seconds.
- Infrastructure as code. Terraform and Ansible carry the baseline, so the next environment is the same design rather than a fresh interpretation of it.
The measured results sit on the Zurich and Kanadevia studies, not as a general promise. At Zurich, compliance gaps fell by 40% and identity-related incidents fell by 70%. At Kanadevia, the landing zone is hub-and-spoke and virtual WAN for Swiss nDSG.