Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The Digital Operational Resilience Act (DORA) and the Revised Network and Information Systems (NIS 2) are two of the latest EU cybersecurity regulations designed to fortify the security posture and cyber resilience of in-scope entities. ‍ Both regulations share the same general purpose of increasing their respective sectors' overall transparency and security. Still, their approaches to this goal vary in several key aspects you’ll learn about in this guide.

NIS 2 is a new EU directive that establishes a unified cybersecurity framework for specific organizations within Member States. Compared to the original NIS directive, the scope has been expanded, and compliance is mandatory for in-scope organizations. ‍ The broader scope means that while NIS 2 is EU-specific, some organizations outside the Union may also be subject to its requirements.

In an increasingly interconnected digital world, supply chain security has become a critical concern for European organizations, policymakers, and national defense agencies alike. With adversaries exploiting software dependencies, contractors, and managed service providers (MSPs), the cybersecurity risks embedded within supply chains have never been more significant.

Over the past few years, many countries have made considerable efforts to bolster cybersecurity preparedness. These efforts are understandable when put into a geopolitical context: global relationships in the past five years have been among the most tumultuous in decades, cybersecurity threats are more sophisticated than ever, and the world is increasingly reliant on digital technologies.

As of January 17, 2025, the Digital Operational Resilience Act (DORA) came into force across all European Union member states, with the crucial aim of strengthening the IT security of financial entities such as banks, insurance companies and investment firms. To do this, the regulation looks to standardize how financial entities report cybersecurity incidents, test their operational resilience, and manage third-party risk.

The Network and Information Systems Directive 2022 (NIS2) was designed to strengthen the cybersecurity resilience of critical infrastructure across the European Union. However, while member states were required to transpose NIS2 into national law by October of 2024, many fell short of this deadline. As a result, on November 28, 2024, the European Commission launched infringement procedures against 23 member states for failing to meet their obligations.

If your SaaS platform collects, processes, or stores EU residents’ data, GDPR compliance is essential to avoid regulatory issues, legal escalations, and operational interruptions. ‍ Due to GDPR’s comprehensive nature, ensuring compliance can be challenging—especially without adequate guidance. ‍ This guide provides granular information to help you start working toward GDPR compliance as a SaaS platform owner. We’ll cover: ‍

The EU’s NIS2 directive came into force on October 17, 2024. Notis Iliopoulos, VP MRC. Obrela explores the latest cyber resilience Directive’s pros and cons and suggests an alternative route the UK government might consider in developing its cybersecurity framework post-Brexit. The NIS2 Directive, which builds upon the original Network and Information Systems (NIS) Directive, aims to enhance the cybersecurity posture of critical sectors across the European Union.

The European Union’s AI Act, set to be enforced in 2025, is set to transform how businesses approach artificial intelligence. Designed to regulate AI development and deployment, the Act aims to ensure ethical, safe, and transparent AI usage. However, many organisations still struggle with compliance.