Is DORA or NIS2 applicable to your organization?

Author

Aurify employee Bram

Bram - CIO

Compliance expert

A guide to understanding the essential security and compliance requirements

In the ever-evolving world of cybersecurity compliance, two key frameworks, DORA and NIS2, are shaping the landscape for European organizations. Navigating these regulations is crucial to ensuring your organization remains compliant, resilient, and secure. In this post, we break down the essentials of DORA and NIS2, their different focuses, and what they mean for your business.

What are DORA and NIS2?

DORA, or the Digital Operational Resilience Act, is a European regulation designed specifically for the financial sector and their suppliers. Its aim is to enhance the cyber security resilience of financial institutions and their providers by ensuring they can withstand, respond and recover from disruptions and cyber incidents. As a regulation, DORA does not require additional enforcement by local authorities. It sets requirements for ICT risk management, incident reporting, and business continuity planning, with a compliance deadline 17 of January 2025.

Starting January 17, 2025, national competent authorities (e.g., financial regulators) will begin monitoring and enforcing compliance with DORA. Entities that fail to meet DORA requirements may face the following consequences:

non-compliant institutions may be subject to increased scrutiny from regulators, resulting in more frequent inspections and audits.

these could limit the scope of activities until compliance is achieved.

penalties may include fines of up to 2% of the financial entity’s annual turnover or other measures, depending on the severity of non-compliance.

NIS2 (Network and Information Systems Directive 2022/2555) is the second version of the Network and Information Security directive, extending its scope to a broader set of industries. The goal of NIS2 is to bolster the cybersecurity of critical organizations, creating a unified level of network and information security across the EU.

NIS2 is a directive and must therefore be transposed into local law. The exact deadlines for NIS2 implementation should be confirmed with local authorities.

For non-compliance with NIS2 requirements, the directive outlines specific penalties, including:

  • Non-monetary remedies: these may include compliance orders, binding instructions, mandatory implementation of security audits, and more.
  • Administrative fines: fines can reach up to at least €10,000,000 or 2% of the global annual revenue, whichever is higher.
  • Criminal sanctions for C-level management: this may include even temporary bans on individuals holding management positions in cases of repeated violations.

Different target audiences: financial vs. critical sectors

The main difference between DORA and NIS2 lies in their intended target audiences. DORA is exclusively aimed at the financial sector and its providers, including cloud and security services. It requires stringent operational resilience measures to protect the financial system from disruptions.

NIS2 targets a broader range of industries and enhances the overall cybersecurity framework of critical entities within the EU. It demands stronger defenses, investment in cybersecurity capabilities, and rapid incident response.

For CIOs in sectors like healthcare, energy, or telecommunications, NIS2 is a significant compliance requirement.
If you’re unsure whether your organization is in scope, try the scoping tool developed by Safeonweb or contact us. We are happy to help you.

What does this mean for your organisation?

Organizations impacted by DORA must establish stronger ICT risk management, implement robust monitoring systems, and prepare for audits.

Companies who fall under NIS2 need to secure networks, systems, and services across various sectors.

Organizations subject to DORA or NIS2 must not only establish clear reporting lines to authorities in the event of an incident but also provide comprehensive information to ensure traceability of the incident. It is no longer sufficient to simply use cloud and security solutions that meet resilience requirements. You must also collaborate closely with security and compliance experts to establish the necessary processes to meet compliance requirements.

By ensuring compliance with DORA or NIS2, your organization will not only meet regulatory standards and strengthen its security posture but also build and maintain trust with clients and stakeholders.

If you have any questions about securing your organization, reach out to us, and we will provide you with the best assistance.

Questions?

Related blogposts