Understanding NIS2 and DORA: Strengthening Cyber Resilience in the EU

This report provides an overview of the EU’s DORA and NIS2 directives and their implications for cyber resilience, detailing requirements for ICT risk management and governance, incident response and strict reporting timelines (e.g., DORA’s rapid notifications and NIS2’s 24/72-hour thresholds), resilience testing, and third‑party risk management. It underscores the growing threat landscape—such as increased DDoS activity in financial services and the CL0P MOVEit supply chain attack—and advocates integrating threat intelligence and continuous monitoring to prioritize risks, detect emerging threats, and streamline response and compliance.