Why even more regulations for effective data protection, you may ask. But every day, large numbers of hacks, data breaches, and other cyber woes show that there's still a lot of work to be done when it comes to keeping information safe. Especially when it comes to personal or other sensitive data.
Like ISO certifications (ISO 27001, ISO 22301), NIS2 and DORA are focused on improving information security, risk management and operational resilience of organizations.
NIS2 is a new directive of the European Union. It is aimed at improving network and information security in critical sectors. Think, for example, of the energy sector, banking and healthcare. But the ever-growing group of SAAS service providers and their customers are also an easy target for malicious parties without good information security.
The Network Information Systems Directive 2, as the directive is called in full, will come into effect in October of this year and is a revision of the original directive, NIS. It has even stricter rules with regard to safety measures and the reporting of incidents and also affects a larger group of companies.
overlap in key requirements of NIS2 and the DORA Act
| Key requirements | NIS2 | DORA |
| Store and manage documents | Necessary | Necessary |
| Record incidents and reports | Necessary | Necessary |
| Audit trail and evidence | Necessary | X |
| Record testing and reviews | X | Necessary |
| Manage service providers | X | Necessary |
| Access management and security | Necessary | X |
The Digital Operational Resilience Act (DORA) is a European regulation that strengthens the digital resilience of financial institutions. This directive will be effective starting 17 January 2025. The directive will apply to banks, lenders and insurance companies, but also to organizations that have ties to such financial organizations. ICT service providers that play an important role in the financial ecosystem, for example, must also meet the strict requirements of this new DORA Act.
An additional challenge with DORA is that European supervisory authorities are still in the process of developing the necessary standards. But before you know it, it'll be January again, so don't wait until all the laws and regulations are set in stone. Start preparing now, so you can be sure that you will stay within the deadlines.
It is a question that many people are asking themselves at the moment. You could write a book about the answer to this question, but in general terms, the combined impact of NIS2 and DORA boils down to the following:
Non-compliance with these regulations can lead to heavy fines, nasty penalties and reputational damage, but you don't want it to get that far. Therefore, below are some tools to prepare your organization for the new regulations.
Of course, before you can improve the existing situation, you first need to know where you are at the moment. A thorough risk analysis is therefore a logical first step and forms the basis for an effective security plan.
Regular pen-testing and vulnerability assessments ensure that your cybersecurity infrastructure keeps up with relevant new developments and cyber threats.
Training staff is something you definitely don't want to overlook. Security is still the work of people, so make sure you have continuous awareness programs in place to keep the knowledge and vigilance of employees up-to-date.
Avoid the pitfall of a one-time approach; compliance with both NIS2 and the DORA Act requires a continuous effort and adaptation to new threats. And you do this not only to comply with the law, but above all to strengthen your cyber resilience. Because in the end, that's what we do it all for.
NIS2 and DORA-ready: why WoodWing Xtendis meets the highest standards of information security out-of-the-box
Automation can be a valuable tool to help you comply with NIS2 and DORA. For example, with the continuous monitoring of your IT infrastructure, providing reports and responding quickly to incidents.
Modern Enterprise Information Management (EIM) systems are also worth their price in gold in the context of NIS2 and DORA. Take WoodWing Xtendis, which is based on more than 30 years of experience in information management and security. Both the Xtendis organization and the software are regularly tested for security by independent third parties. If you use WoodWing Xtendis, your out-of-the-box will be 90% compliangt with NIS2 and the DORA Act.
Would you like to know more about these important new directives and how you can best anticipate their introduction in practice? Be sure to contact the specialists at WoodWing Xtendis – they will be happy to provide you with sound advice.