EC Adopts NIS2 and DORA Directives

The NIS2 Directive aims to strengthen cybersecurity risk management requirements as well as ensure companies that take appropriate and proportionate technical, operational, and organizational measures to manage the cybersecurity risks as well as prevent and minimize the impact of potential incidents. The NIS2 Directive will ensure a safer and stronger Europe by expanding significantly the sectors and type of entities falling under its scope and by strengthening security requirements for companies. The NIS2 Directive will replace the current Directive on Security of Network and Information Systems. The NIS2 Directive focuses on measures including incident response and crisis management, vulnerability handling and disclosure, policies and procedures to assess the effectiveness of cybersecurity risk management measures, and cybersecurity hygiene and training. To help enhance information-sharing and cooperation on cyber crisis management at both national and EU levels, the NIS2 Directive streamlines incident reporting obligations with more precise provisions on reporting, content, and timeline. Furthermore, there are more stringent supervisory measures for national authorities, as well as stricter enforcement requirements, along with the list of administrative sanctions, including fines for breach of the cybersecurity risk management and reporting obligations. Members states will have to transpose the NIS2 Directive into national law within 21 months from the entry into force of the Directive. During this time, member states shall adopt and publish the measures necessary to comply with this Directive.

The DORA Amending Directive (Directive 2022/2556) will amend other Directives to align with DORA, including CRD IV, Solvency II, MiFID II, PSD2, UCITS and AIFMD. In-scope entities include credit institutions, payment institutions, electronic money institutions, investment firms, and crypto-asset service providers. Regulation 2022/2554 sets out uniform requirements concerning the security of network and information systems supporting the business processes of financial entities. It covers rules and requirements: 

• applicable to information and communication technology (ICT) risk management; reporting of major ICT-related incidents and notifying, on a voluntary basis, significant cyber threats to the competent authorities; reporting of major operational or security payment-related incidents to the competent authorities by specified financial entities; and digital operational resilience testing; information and intelligence sharing in relation to cyber threats and vulnerabilities; and measures for the sound management of ICT third-party risk             
• on the contractual arrangements concluded between ICT third-party service providers and financial entities
• for the establishment and conduct of the Oversight Framework for critical ICT third-party service providers when providing services to financial entities
• on cooperation among competent authorities, and rules on supervision and enforcement by competent authorities in relation to all matters covered by this Regulation

Related Links

• Press Release on NIS2 Directive
• Regulation on NIS2 Directive
• Factsheet on NIS2 Directive
• Regulation on Digital Operational Resilience
• Directive on Digital Operational Resilience

Keywords: Europe, EU, Banking, Regtech, NIS2, Cyber Risk, DORA, Operational Resilience, ICT Risk, NIS Directive, EC