CYBERSECURITY
DORA and NIS2, turned into concrete measures
Risk governance, incident handling and notification duties: the European security obligations taken from the statute to the procedures that make them real.
Information security has become a matter of law. DORA for the financial sector and NIS2 for a wide range of essential and important entities impose specific obligations on risk governance, incident handling and dealings with the authorities, with responsibilities reaching up to senior management. Technical measures are not enough: they must rest on an organisational and documentary framework that shows the right choices were made. I address cybersecurity from the legal and governance side, complementing the technical work: I identify which obligations apply to the organisation, turn them into verifiable policies and procedures, and set up incident management before it is actually needed, when reconstructing in a hurry is no longer possible.
WHAT IT INCLUDES
What it includes
Scope of application
Checking whether and how DORA and NIS2 apply to the organisation and what obligations follow in practice.
Risk governance
Setting up security policies and responsibilities, up to the obligations resting on senior management.
Incident handling
Procedures for detection, classification and response, with the notification flows to the authorities within the required deadlines.
Supply chain
Oversight of the risk from ICT service providers, with the contractual safeguards and controls required.
Documentation and audit
Preparing the documentation to support the controls and audits of the competent authorities.
Integration with privacy
Coordination between security and the GDPR, from data breach handling to data protection measures.
WHO IT IS FOR
Who it is for
The service is aimed at financial entities within DORA's scope and at organisations that fall among the essential or important entities under NIS2, as well as at those providing ICT services to them and inheriting the obligations by extension. It is useful both to check the scope of application and to build the governance framework and incident management.
FREQUENTLY ASKED
Frequently asked questions
Does my company fall under NIS2? And under DORA?
NIS2 applies to a wide range of essential and important entities in sectors such as energy, transport, health and digital infrastructure, above certain size thresholds. DORA applies instead to the financial sector and its ICT service providers. The two regimes can overlap: checking the scope of application is the first step to understanding which obligations concern you.
What do DORA and NIS2 require in practice?
Both require a framework for information-risk governance, with responsibilities reaching up to senior management, procedures for handling and notifying incidents within the required deadlines, and oversight of the risk from ICT service providers. Technical measures are not enough: you need policies, procedures and documentation that demonstrate the choices made.