Fast Facts

• NIS2, DORA, and CER are three major EU cybersecurity regulations coming into force between 2024 and 2025.
• Over 50,000 Italian companies alone are affected by these overlapping rules, with similar impacts across the EU.
• DORA targets financial sector digital resilience; NIS2 covers 18 critical sectors; CER bridges physical and cyber infrastructure security.
• Compliance costs for mid-sized firms can reach up to €500,000, with SMEs facing the steepest challenges.
• Regulatory complexity may favor large firms and raise geopolitical tensions over non-EU tech providers.

The New Digital Iron Curtain

Picture a fortress: not of stone, but of code, contracts, and committees. This is the new reality for European organizations as three heavyweight regulations-NIS2, DORA, and CER-descend almost simultaneously, demanding a level of digital and operational resilience never before seen. For thousands of businesses, especially in finance, energy, and digital infrastructure, compliance is no longer just a box-ticking exercise-it’s a matter of survival in a world under constant cyber siege.

The Pillars of Compliance: NIS2, DORA, CER

NIS2 (Network and Information Security Directive 2) broadens the net, covering everything from health to water to transport-18 sectors in total. DORA (Digital Operational Resilience Act) zeroes in on the financial world, setting rigorous standards for banks, insurers, and even their tech suppliers. CER (Critical Entities Resilience) completes the triangle, stitching together digital and physical security requirements for essential infrastructure. The intention: no more regulatory silos, but one integrated defense against threats that don’t respect sector boundaries.

But this fortress is complicated. DORA is so detailed it makes NIS2 look almost generic, and CER adds a layer of physical risk management that most IT teams aren’t used to. Many organizations find themselves caught in a regulatory tug-of-war-subject to multiple authorities, deadlines, and sometimes conflicting interpretations. For instance, a cloud provider serving banks must meet both NIS2 and DORA requirements, with different reporting lines and timelines.

Lessons from the Frontlines

Real-world experiments are already underway. Poste Italiane, Italy’s postal and financial giant, has launched a supply chain resilience program to help smaller suppliers meet new standards-an effort echoed across the EU as big firms realize they’re only as secure as their weakest link. Meanwhile, European banking regulators are mapping out which tech giants, especially non-EU cloud providers, will be subject to DORA’s direct oversight-a bold move, given the geopolitical friction it introduces with companies like AWS and Microsoft Azure.

Elsewhere, energy operators are learning the hard way that cyber and physical risks can’t be managed in isolation. Only by adopting unified risk frameworks-like ISO 31000, tailored to the new legal landscape-have some managed to untangle conflicting demands and avoid duplicative audits.

The Hidden Costs and Risks

Compliance isn’t cheap. ENISA, the EU’s cybersecurity agency, reports that IT security now swallows nearly 10% of total IT budgets in Europe, with SMEs feeling the squeeze the most. There’s a real danger that only the largest firms can afford to keep up, potentially distorting competition and cementing the dominance of digital giants.

And the rules themselves are not immune to criticism. The more detailed and prescriptive they become, the harder it is to adapt to fast-moving threats-think AI-powered attacks or quantum risks, which the current laws barely mention. Add translation quirks (like “multi-risk” versus “all-hazards” in different legal texts) and you have a recipe for confusion, not clarity.

WIKICROOK

• NIS2 Directive: The NIS2 Directive is an EU law requiring critical sectors and their suppliers to strengthen cybersecurity and report serious cyber incidents.
• DORA (Digital Operational Resilience Act): DORA is an EU regulation that requires financial firms to prove they can handle and recover from cyber incidents, ensuring digital resilience.
• CER Directive: The CER Directive is an EU law ensuring key infrastructure sectors manage both physical and cyber risks to maintain essential services.
• Supply Chain Security: Supply chain security ensures that all parts of a product or service’s journey are protected from cyber threats, tampering, and foreign control.
• Incident Reporting: Incident reporting is the structured process of alerting authorities or stakeholders about security breaches, outlining the event and actions taken to resolve it.