European Council Aligns NIS2 Directive with DORA for Financial Sector

The European Council agreed on its general approach on measures for a high common level of cybersecurity across the European Union, to further improve the resilience and incident response capacities of both the public and private sectors. Once adopted, the new NIS2 directive will replace the current directive on security of network and information systems (the NIS directive). NIS2 will set the baseline for cybersecurity risk management measures and reporting obligations across all sectors that are covered by the directive. The Council has aligned the text with sector-specific legislation, in particular the regulation on digital operational resilience for the financial sector (DORA) and the directive on the resilience of critical entities (CER), to provide legal clarity and ensure coherence between NIS2 and these acts. Member states would have two years from the entry into force of the directive in which to incorporate the provisions into their national law.