Three regulations, one direction
NIS2, DORA and GDPR have different scopes but share the same principle: those who lead the organisation must approve risk management measures, oversee their implementation and be able to demonstrate their adequacy.
| Regulation | Who it applies to | Role of the board | Incident reporting |
|---|---|---|---|
| NIS2 It. Legislative Decree 138/2024 | Essential and important entities in critical sectors: energy, transport, healthcare, public administration, digital, manufacturing and others | Approves measures, oversees their implementation, undergoes dedicated training and is accountable | Early warning within 24 hours, notification within 72 hours, final report within one month |
| DORA Reg. (EU) 2022/2554 | Financial entities and the third-party ICT providers serving them; applicable since 17 January 2025 | The management body bears ultimate responsibility for ICT risk and approves the management framework | Initial notification within 4 hours of classification as major (and no later than 24 hours after detection), intermediate within 72 hours, final within one month |
| GDPR Reg. (EU) 2016/679 | Every organisation processing personal data | The controller is accountable for the adequacy of technical and organisational measures | Data breach notified to the supervisory authority within 72 hours; communication to data subjects if the risk is high |
Management bodies are required not only to ensure security, but to be able to demonstrate its adequacy.
One incident, several obligations
A ransomware attack on a hospital, a bank or a utility can trigger several regulations at once, with different authorities and deadlines. Without a single process, the first hours are spent working out who to tell what.
- 4 hours
- DORA: initial notification
- 24 hours
- NIS2: early warning to the CSIRT
- 72 hours
- NIS2 and GDPR: notification
- 1 month
- NIS2 and DORA: final report
A single system of controls
The efficient response is not to multiply compliance projects, but to build a single system of controls that meets the common requirements: governance and roles, risk management, incident response, supplier control, resilience testing, operational continuity and board training.
Five questions for the board
- Which regulations apply to our organisation, and to which of our companies or services?
- Who is accountable for digital risk, and with what mandate?
- Do we have a single incident management process that meets all reporting deadlines?
- Which suppliers pose the highest risk to our continuity?
- Which indicators do we use to measure our posture over time?
Integrated NIS2 · DORA · GDPR assessment
Regulatory scope, gap analysis against a single control framework, compliance plan and board briefing.
Explore Advisory & Education