Why DORA Doesn’t Cover All Banking — and Where NIS2 Applies Instead
DORA doesn’t cover all banking. Sub-threshold AIFMs, MiFID II-exempt firms and post-office giro institutions remain under NIS2. Map the exact boundary for your entity.
-
-
How Public Administration Must Comply With NIS2: 10 Article 21 Obligations for Central and Regional Government
NIS2 classifies central and regional government entities as essential. Covers 10 Article 21 obligations, what’s excluded, and procurement requirements.
-
NIS2 Annex I, Sections 8–9: The OT and SCADA Security Requirements Water Utilities Must Meet Before Their First Audit
This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation. In February 2021, an…
-
NIS2 in Poland: Registration, CSIRT Reporting, and UKE Authority Under the Amended KSC
42,000 Polish organisations now covered by NIS2. Identify your competent authority, CSIRT reporting contact, and meet the October 3, 2026 registration deadline.
-
NIS2 in Spain: How the INCIBE-CERT vs CCN-CERT Split Determines Who Regulates Your Organisation
Which NIS2 authority supervises your Spanish operations — INCIBE-CERT or CCN-CERT? ENS overlap, draft law status, €10M penalties, and action steps.
-
Operating in France Under NIS2? What ANSSI Requires That Your EU Compliance Plan Likely Misses
Your EU NIS2 programme likely has gaps for France: ANSSI’s ReCyF has 20 objectives and ISO 27001 covers only 2. Here’s what to fix before registration opens.
-
NIS2 in Germany: What Multinationals Must Actually Do Under BSIG 2.0 — BSI Registration, KRITIS Overlap, and Penalty Exposure
Germany’s NIS2 via BSIG 2.0: BSI registration, KRITIS scope, personal management liability, and ICT component prohibition. Step-by-step guide for multinationals.
-
Operating in Italy? NIS2 Is Now Law — Here’s What ACN Requires from Your Business
Italy NIS2 is live. ACN notified entities in April 2025 — learn registration steps, CSIRT reporting rules, and the October 2026 compliance deadline.
-
NIS2 Network Security: The 4-Zone Segmentation Model That Satisfies CIR Annex Requirements
Most networks don’t meet CIR Annex 6.7 and 6.8 — here’s the 4-zone segmentation model that satisfies NIS2 network security requirements.
-
NIS2 Vulnerability Management Under CIR Annex 6: Patch SLAs by CVSS Score, OT Compensating Controls, and CVD Requirements
CIR Annex 6 §6.6 and §6.10 impose separate patch management and vulnerability handling obligations. Includes CVSS-tiered patch SLA table, OT compensating controls framework, and CVD procedure requirements for NIS2 compliance.
