​​Securing critical infrastructure: Why Europe’s risk-based regulations matter

This Microsoft Deputy CISO blog outlines how the evolving cyber threat landscape—spanning cybercrime and state-backed activity—demands a risk-based approach to security and resilience, reinforced by EU regulations NIS2 and DORA that elevate CISO governance and board accountability. It emphasizes prioritizing high-impact controls (like phishing-resistant MFA), operational resilience, and measurable oversight through a concise set of Key Control Indicators (KCIs) covering asset inventory, privileged access, patching, backups, logging, network and third-party security, and cryptography. The piece positions compliance as a means to societal and business continuity, urging modern defenses, cross-sector collaboration, and rigorous measurement to protect critical infrastructure.