What NIS2 and DORA require, who they apply to and how to prepare your security and resilience programs.
Two major European regulations are raising the bar for cyber resilience: the NIS2 Directive and the Digital Operational Resilience Act (DORA). Both affect organizations beyond Europe that serve European customers.
NIS2 in brief
NIS2 (Directive (EU) 2022/2555) expands cyber security obligations to a wide range of essential and important entities, including energy, transport, health, digital infrastructure, ICT service management and more. Key requirements include:
- Risk management measures covering policies, incident handling, business continuity, supply chain security, vulnerability management and cryptography.
- Incident reporting with an early warning within 24 hours and a notification within 72 hours.
- Management accountability for approving and overseeing measures.
DORA in brief
DORA (Regulation (EU) 2022/2554) applies from 17 January 2025 to financial entities and their critical ICT providers. It rests on five pillars:
- ICT risk management.
- ICT incident management and reporting.
- Digital operational resilience testing.
- ICT third-party risk management.
- Information sharing.
How to prepare
- Determine whether you are in scope directly or as a supplier.
- Run a gap assessment against the requirements.
- Build a risk register and a third-party inventory.
- Define incident classification and reporting workflows.
- Test resilience through exercises and technical testing.
- Brief leadership, who carry accountability.
Applicability and national implementation vary, so confirm obligations with legal counsel. Our NIS2 and DORA consulting teams support readiness and implementation.
digital operational resilienceDORA complianceEU cyber security regulationNIS2 compliance
