NIS2 and DORA are going to change the approaches to cybersecurity and data protection in organizations.
NIS2 is the second directive on NIS and has better and advanced features than the first NIS Directive that was adopted in 2016. Its main aim is to enhance the level of safety and security of the essential facilities in the European Union territory. On the other hand, DORA is an extensive EU regulation that aims to improve the operational resilience of the financial sector which implies that they are able to protect against, absorb, adapt to, and recover from any disruptions including cyber threats.
What is critical in such situations is to understand these regulations and prepare for the transformations that are bound to occur.
The NIS2 and DORA compliance
Most organizations located in the EU will primarily pay attention to the NIS2 and DORA frameworks. These two regulations provide high-bar that organizations have to meet to avert severe fines and damaging brand image.
Under NIS2, organizations designated as “essential” or “important” entities will be subject to a range of security and risk management measures, including:
- Reporting serious incidences to the authorities
- Auditing and assessment should be done periodically and can be defined as the process of reviewing and evaluating an organization.
- The safeguarding of their supply chains
DORA, on the other hand, will require financial entities to:
- The enhancement of specific digital operational resilience frameworks
- Research and record all incidences that are in some way related to Information and Communication Technology.
- Make sure that they conduct their systems’ checkups and assessments of the implemented processes and procedures occasionally.
- Discover the toughest outsourcing and third-party risk management requirements
- Businesses will have to go back and reconsider the current cybersecurity and operational continuity solutions according to the requirements set in NIS2 and DORA.
Impacts of NIS2 and DORA on Businesses
NIS2 and DORA will bring changes for enterprises of different sectors and especially for those which will be identified as ‘essential’ or ‘important’ according to NIS2 or if they belong to the financial sector.
- Expanded Scope: Both regulations will expand the definition of critical infrastructure from the traditional perspectives of sector, and will engage healthcare, transport, energy and finance.
- Increased Compliance Obligations: It will imply that organizations will be under greater security and risk management measures, which require a significant amount of manpower, processes, and equipment for enforcement.
- Heightened Incident Reporting: The companies will be required to report the incidents to the authorities, hence, the risks and weaknesses will be visible to the regulators.
- Enhanced Supply Chain Security: Businesses will be forced to focus on supply chain threats and, in particular, the security situation of third parties.
- Potential Financial Penalties: Failure to observe the provisions of NIS2 and DORA is punishable by law and the penalties include fines that can be as high as 2% of the total turnover of the firm in question.
Challenges in the Implementation of NIS2 and DORA
Implementing the requirements of NIS2 and DORA presents several challenges for businesses:
- Complexity of Compliance: The regulations are all-round and the security and risk management processes that they require can be very challenging to administer by the organizations.
- Resource Constraints: Organisations and companies could also fail to allocate sufficient capital and human resource to implement the observed cybersecurity and operational resilience measures.
- Talent Shortage: This is because there is an emerging concern of skilled cybersecurity workers’ scarcity, which limits organizations from acquiring and training the necessary workforce to implement the regulations.
- Integration with Existing Systems: Like in any other upgrade, there is always a need to integrate the new security and risk management requirements into a company’s existing IT network and this is not an easy process and always takes time.
- Evolving Regulatory Landscape: Therefore, the compliance can turn into the process that may be adjusted in the future as threats and regulations in the sphere of cybersecurity evolve.
Opportunities of NIS2 and DORA for Cybersecurity
Despite the challenges, the implementation of NIS2 and DORA can bring significant benefits to the cybersecurity landscape:
- Improved Resilience: These regulations will help organisations enhance their security and the business continuity of the critical infrastructure and the financial industry against cyber risks and incidents.
- Enhanced Collaboration: The increase of cooperation and exchange of information between the member states is provided by NIS2 and DORA and, therefore, these should contribute to the better results in combating the cybersecurity threats.
- Increased Accountability: Because of the reporting requirements and a potential for receiving large fines, the businesses will be incentivised to become more tightly responsible for cybersecurity.
- Harmonized Standards: The regulations will, therefore, guarantee the homogeneity and consistency of the cybersecurity and operational resilience standards in the EU, thus improving data protection and incident management.
- Competitive Advantage: Those organizations that are ready to fulfill the requirements of NIS2 and DORA can get a competitive benefit in the market, demonstrating the organization’s commitment to cybersecurity and business continuity.
Conclusion
Further expanding the threat of cybersecurity, the changes that have occurred with the assistance of NIS2 and DORA can be regarded as new phases of regulating this sphere. These regulations will make organisations to change their strategy on cybersecurity and business continuity, invest on new technologies and processes and increase interaction with the authorities and partners.
Still, it remains clear that despite the fact that the addition of NIS2 and DORA will have its own problems, the scale of the picture of the cybersecurity industry is immense. Therefore, by agreeing with such standard and responding to these challenges in advance, such firms can be ready for the additional development of the road ahead and the new conditions and threats coming from the cyber space.
