DORA and NIS2: Expecting the Worst to Achieve Cyber Resilience