BIG CHANGES IN EU CYBERSECURITY, EXPLAINED BY CYEN

Digital Operational Resilience Act (DORA)

DORA is the first comprehensive cyber resilience regulation for the financial sector. It is directly applicable to all companies in scope operating on the EU market, with a compliance deadline of January 2025. While the scope is more limited than NIS 2, the requirements are more specific. Major challenge in DORA implementation is the critical ICT supplier management and assessment requirements and the close collaboration between different teams (legal, cyber, IT, purchasing, risk,...) within the entity to ensure the implementation of DORA's comprehensive measures.

What can companies do to implement DORA? Identify whether national regulator guidance imposes stricter rules. Plan, implement and check the implementation of each legal requirement. Pay attention to the contract management and critical ICT supplier management.

Network and Information System Security Directive (NIS 2)

NIS 2 regulates 18 critical sectors, including energy, health, transport, ICT service management and manufacturing, amongst others, and by extension, to their supply chain. It imposes cybersecurity, risk management and incident reporting. Major challenges for companies implementing NIS 2 are the supply chain management, including evidencing compliance, and prompt incident reporting deadlines.

What can companies do to implement NIS 2? First, identify whether the national law transposing the EU NIS 2 Directive in your (or your clients') country imposes stricter rules. Then, plan, implement and check the implementation of each legal requirement. Pay attention to the cybersecurity incident notification delay and process!

Your cybersecurity compliance contact: Iva Tasheva Co-Founder, Cyen, phone: +32 493 405 612

iva.tasheva@CyEn.eu

www.cyen.eu