NIS2 vs. DORA: A Cybersecurity Showdown for Essential Entities

With the development of the digital environment and with the growing number of cyber threats, the requirements for effective cybersecurity have become a necessity especially for what is considered an ‘essential entity.’ These entities are organizations that provide services that are considered essential in the operation of our society and economy such as critical infrastructure, financial, and public sector organizations. Even the slightest disturbance or violation of their secure space can lead to colossal repercussions affecting millions of people and the existence of countries.

In this ever-changing cybersecurity landscape, two major regulatory frameworks have emerged: The EU’s Network and Information Systems Directive (NIS2) and the Digital Operational Resilience Act (DORA). These regulations are designed to protect critical assets by setting out comprehensive security measures and business continuity specifications. It is important to know the differences between NIS2 and DORA to allow the necessary entities in the network to cope with the complicated regulatory environment and have a secure and compliant cybersecurity system.

NIS2 – The Network and Information Systems Directive

NIS2 stands for Network and Information Systems Directive, which is an EU directive that is a continuation of the NIS directive that was passed in the year 2016. NIS2 is a progression from the first NIS directive and is a positive development in the EU’s attempts to increase the protection of critical infrastructure and essential services. The directive lays down the baseline of security measures and responsibilities that organizations in different sectors such as energy, transport, banking, financial market structures, healthcare, and digital infrastructure should meet.

Another significant improvement of NIS2 is the notion of the broader range of entities, which can be affected by information risks and threats, such as medium and large enterprises and public sector organizations. The idea of this expansion is to achieve a better understanding of cybersecurity and its regulation in the entire territory of the EU. Also, NIS2 has established more rigid measures on security and incident reporting, and organizations may be subjected to significant fines.

DORA – The Digital Operational Resilience Act

Another critical EU legislation that is expected to affect core entities is the Digital Operational Resilience Act (DORA). DORA is a broad framework to enhance the operational resilience of the financial sector to enable the relevant entities in finance and other sectors to prevent and recover from different disruptions, including cyber risks.

DORA lays down a framework of co-ordinated rules and obligations with regard to ICT risks such as cybersecurity, third party risk management and reporting of incidents. The regulation covers various financial organizations such as banks, investment companies, insurance companies and other participants in the financial markets.

Main Distinctions between NIS2 and DORA

While NIS2 and DORA share the common goal of enhancing cybersecurity and operational resilience, there are several key differences between the two frameworks:

Scope and Applicability:

NIS2 is less specific than NIS1: it is applied to a greater number of key objects and is used for both state and municipal organizations as well as commercial ones.

DORA is majorly concerned with the financial sector since it will be implemented on the financial institutions and other related parties within the financial chain.

Regulatory Oversight:

NIS2 is implemented by the national competent authorities of each EU member state.

The operation of DORA is supervised by the European Supervisory Authorities; EBA, ESMA and the EIOPA.

Reporting Requirements:

NIS2 has certain requirements for incident reporting, it is necessary to report serious incidents to national bodies.

DORA adds more specific and extensive reporting obligations for ICT-related events and threats and provides the timeframes and subjects that must be reported.

Third-Party Risk Management:

NIS2 mandates that essential entities ought to identify and mitigate risks from the supply chain and third-party service providers.

DORA lays greater focus on third-party risk management within the context of ICT, which implies that financial entities must carry out due diligence and monitor the performance of ICT service providers.

Compliance and Enforcement:

NIS2 and DORA hold substantial fines and penalties for non-compliance but the amount of fines as well as the enforcement of the fines differ.

It is important to understand these differences for essential entities when it comes to the compliance with the new regulations and implementation of cybersecurity and operational resilience measures in accordance with the requirements of NIS2 and DORA.

NIS2 and DORA’s Effects on the Essential Entities

NIS2 and DORA will influence the key entities, and as a result, they will have to reconsider and enhance the cybersecurity and operational resilience plans.

For the organizations that fall under NIS2, the directive will require the organizations to provide security measures such as appointing a security official, having a plan for handling the incidents, and the use of sophisticated security technologies. Furthermore, NIS2 will oblige crucial stakeholders to carry out risk analyses, integrate vulnerability management procedures, and inform national bodies of critical occurrences.

In the same way, DORA will significantly influence the participating financial institutions and other related entities within the financial sector. These organizations will have to develop complex ICTRM programs and sets of measures, integrate sophisticated security measures, and guarantee the sustainability of their key business processes. DORA will also impose due diligence obligations on financial entities’ third-party service providers and detailed reporting and response requirements.

Legal and Regulatory Framework in the Context of NIS2 and DORA

Implementing the requirements of NIS2 and DORA will be one of the critical concerns for the necessary entities. The two frameworks demand specific regulatory compliance and severe consequences for non-adherence, emphasizing the need for proactive and comprehensive cybersecurity strategies.

Under NIS2, essential entities will be required to:

• Appoint an official in charge of security in the organization to oversee the security of its’ systems.
• It is necessary to set up protection mechanisms, such as access rights, encryption, and assessment of potential threats.
• Create and periodically review the incident response and business continuity plans

The significant incidents must be reported to the national authorities within the stipulated time.

DORA, on the other hand, will require financial entities to:

• Develop ICT risk management policies, processes and controls that will act as a guide in managing ICT risks.
• Risk analysis and applying the right security features
• Ensure that there is a proper documentation of the incidents and proper documentation of the response mechanisms.
• Protect their core processes and their partners.

NIS2 and DORA’s noncompliance attracts serious penalties, therefore; essential entities should pay attention to the compliance and utilize every means to improve their cybersecurity and operational resilience.

Effective and Efficient Cybersecurity Measures That Must Be Adopted by Essential Entities

To effectively navigate the complex regulatory landscape and ensure compliance with NIS2 and DORA, essential entities should adopt the following best practices for cybersecurity:

• Comprehensive Risk Assessment: Carry out comprehensive risk analysis to evaluate risks and threats, and their consequences in relation to your organization’s valuable resources and activities.
• Robust Security Controls: Adopt security measures such as restricting access to confidential information, practicing data encryption, scanning for vulnerabilities, and using threat intelligence tools.
• Incident Response and Business Continuity Planning: Incident response and business continuity plans should be created and updated frequently for the organization to be in a position to handle and recover from different types of disruptions that include cyber incidents.
• Third-Party Risk Management: Implement a strong third party risk management program that evaluates, monitors, and controls risks in your organization’s supply chain and service providers.
• Continuous Monitoring and Improvement: Consistently review your cybersecurity position, review security events and patterns, and apply regular changes to maintain a strong cybersecurity position against new threats and to be in compliance with new regulations.
• Employee Awareness and Training: Bring in proper training and awareness sessions for the employees to prepare them for any possible cyber threat that may be encountered.
• Collaboration and Information Sharing: Maintain open communication with other organizations in the industry, regulating bodies and cybersecurity professionals in order to get updates on new threats, new industry standards and new regulations.

Through the implementation of the outlined best practices, essential entities can enhance their cybersecurity and operational readiness, counter the threats resulting from the NIS2 and DORA legislation, and maintain the uninterrupted provision of vital services to their stakeholders.

Conclusion

On the cybersecurity of essential entities, the current and future state is characterized by changes and new opportunities arising from NIS2 and DORA. When these regulatory frameworks are implemented, the essential entities need to know the distinguishing features of NIS2 and DORA and take necessary measures to stay compliant and improve cybersecurity.

Thus, by following the proposed comprehensive approach to cybersecurity, utilizing the best practices, and being aware of the changes in the legal and regulatory requirements, the essential entities will be able to succeed in this environment and protect their valuable assets, services, and stakeholders’ trust.