NIS2 and DORA: a pragmatic implementation plan for your teams

NIS2 vs DORA: what changes in practice

NIS2 and DORA are often mentioned together, sometimes confused, and almost always perceived as a regulatory mountain. The right starting point is to distinguish their respective approaches. NIS2 strengthens cyber resilience requirements for entities considered essential or important across many sectors. DORA focuses more specifically on digital operational resilience in the financial sector and its ecosystem.

In both cases, the message is the same: having written policies is no longer enough. Organisations must demonstrate operational capabilities: active governance, risk management, detection, response, recovery, third-party management and evidence of control. This marks a shift from declarative compliance to compliance through execution.

For senior management, this means cybersecurity is no longer a purely technical matter. It concerns business continuity, customer relationships, governance accountability and sustainable performance. For IT departments and CISOs, the challenge is to turn obligations into a practical management framework.

Organisational impacts on IT, CISOs and business teams

The main impact of NIS2/DORA is organisational. Roles must be clarified, decision-making channels shortened and responsibilities for producing evidence formalised. An information security policy disconnected from operations is not enough. Organisations need functioning processes: vulnerability management, incident response, continuity testing, third-party assessment and management reporting.

The change is equally significant for business teams. They become active contributors to resilience because cyber incidents primarily create business impacts: service disruption, production delays, unavailable information and loss of customer trust. Business teams must therefore participate in crisis exercises, the prioritisation of critical assets and recovery decisions.

For management, the new responsibility is to make explicit risk decisions. Accepting a risk without an audit trail is no longer defensible. Choices, mitigation plans and follow-up activities must be documented. This discipline is demanding, but it strengthens the organisation's overall robustness.

A 90-day plan to launch compliance

Days 0–30: scoping and visibility

First action: appoint an executive sponsor and an operational lead. Without this pairing, the programme will remain theoretical. Second action: map critical assets and processes. Third action: conduct a rapid assessment of existing controls and major gaps.

At the same time, define a minimum dashboard covering critical risks, significant incidents, overdue actions and the coverage level of essential controls. The objective is not absolute precision, but the ability to manage the programme.

Days 30–60: prioritisation and planning

Build a backlog of prioritised workstreams: governance, detection, incident response, continuity, third parties and awareness. For each workstream, define the owner, objective, milestones and expected evidence. Ensure that every action is linked to a specific risk.

Then establish a monthly committee meeting. Decisions must be recorded: risk accepted, risk treated or risk transferred. This traceability is essential to the framework's credibility.

Days 60–90: execution and evidence

Launch visible, measurable actions: MFA and the hardening of privileged access, recovery tests, reviews of critical third parties, alert scenarios and a tabletop crisis exercise. Document the results, gaps and corrective measures. After 90 days, you should be able to demonstrate that the programme exists in practice, not only in presentation slides.

Policies and controls to prioritise

Organisations often get lost in drafting numerous documents. It is better to start with fewer policies that are genuinely applied. Common priorities include:

• Cyber risk governance and responsibilities.
• Identity and access management.
• Vulnerability and patch management.
• Incident management and communication.
• Business continuity, recovery and testing.
• Critical third-party management.

Each policy must be linked to controls that can be verified in practice. Example: access policy -> quarterly access rights reviews, logging of administrator accounts and a defined timeframe for deleting accounts when people leave. This policy-control-evidence link is the key to defensible compliance.

How to avoid compliance projects that exist only on paper

A paper-based compliance project is easy to recognise: extensive documentation, few indicators, limited testing and weak adoption by business teams. Adopt four principles to avoid this.

First principle: one action = one expected item of evidence. If you do not know what evidence to produce, the action is poorly defined. Second principle: conduct a monthly management review based on a short, consistent dashboard. Third principle: integrate resilience requirements into business-side IT project management so that they are addressed from the design stage. Fourth principle: run regular exercises, because resilience must be tested in real-world situations.

Compliance then becomes a consequence of operational maturity rather than a bureaucratic end in itself.

Management dashboard

A good management dashboard should be no longer than one page. It may contain:

• Top 10 residual risks with trends.
• Progress on priority workstreams.
• Major incidents and lessons learned.
• Coverage level of critical controls.
• Status of critical third parties, including assessments and remediation plans.
• Results of continuity tests and crisis exercises.

Each indicator should prompt a decision. If an indicator never triggers discussion or a management decision, it serves no purpose.

Alignment with GDPR, quality and IT performance

NIS2 and DORA do not operate in isolation. They naturally connect with GDPR, quality management and IT performance. Cyber incidents often affect personal data, SLAs and user satisfaction. Unified governance helps avoid duplicate committees and reporting.

In practice, you can align:

• The critical asset map with the record of processing activities.
• Business continuity plans with quality processes.
• Cybersecurity requirements for suppliers with GDPR contractual clauses.
• Cybersecurity KPIs with service KPIs such as availability, response times and incidents.

This integration is particularly useful for mid-sized companies, where multiple obligations can overwhelm teams. By harmonising frameworks, you reduce the administrative burden and make decision-making clearer.

Scoping a digital resilience programme

For an organisation that depends heavily on digital systems, scoping connects existing initiatives to common governance. Responsibilities, priorities and timing are defined according to applicable obligations and operational constraints.

Work may cover critical asset inventory, privileged access, incident management, crisis exercises and major service providers. Each action identifies the evidence required and its owner.

Progress is assessed using completed controls and available evidence, without implying achieved compliance or a guaranteed completion time.

Quick FAQ

Should NIS2 and DORA be handled through two separate programmes?

Not necessarily. A common resilience foundation can cover a large proportion of the requirements, with sector-specific adjustments.

What is the first useful deliverable?

A map of critical assets and a backlog of prioritised workstreams with assigned owners and evidence requirements.

Who should lead the programme?

An executive sponsor and an operational lead, working closely with IT management, the CISO, business teams and compliance functions.

Learn more

To turn these requirements into action, explore Cybersecurity and IT project advisory. For market-segment considerations, the Public sector, SMEs and mid-sized companies page provides useful guidance. If you would like to define a roadmap tailored to your needs, contact us through Contact OLING.

One final practical recommendation: start small, but make the work visible. Building evidence creates internal buy-in and facilitates subsequent decisions.