The EU's NIS2 Directive and the Digital Operational Resilience Act (DORA) raise the bar on cyber risk management, incident reporting and supplier oversight. Whether they apply to you depends on your sector, size and services, so confirm scope with legal counsel first.
A sensible order of work
- Confirm applicability and who in your group is in scope.
- Run a gap assessment against the control requirements.
- Stand up incident reporting: know what counts as significant, who decides and the reporting clocks that apply.
- Map your suppliers and critical third parties, then review contracts and exit plans.
- Give leadership ownership: both regimes put accountability on management bodies.
- Test: tabletop exercises and recovery tests give you evidence as well as confidence.
This article is general information, not legal advice.