Are Cybersecurity Regulations Enough?
Europe has never regulated cybersecurity as hard as it does now. The Digital Operational Resilience Act (DORA), the revised Network and Information Security Directive (NIS-2) and the Cyber Resilience Act (CRA) together amount to the most ambitious push for digital security in a generation.
The harder question sits underneath all of it. Does meeting these requirements actually make an organisation secure?
The Regulatory Wave
The three instruments and what they cover:
- DORA (effective January 2025) mandates ICT risk management, incident reporting, resilience testing and third-party risk management for financial entities across the EU.
- NIS-2 (transposition deadline October 2024) expands the scope of the original NIS Directive to more sectors and imposes stricter requirements for risk management and incident reporting.
- CRA introduces cybersecurity requirements for products with digital elements throughout their lifecycle.
The direction is consistent across all three: cybersecurity is no longer optional, and accountability reaches the boardroom.
Where Compliance Falls Short
Regulations set a minimum. They define what organisations must do, and they have to be drafted generically enough to apply to thousands of very different organisations. What they cannot do is account for your particular threats, your technology stack or your risk appetite.
1. Compliance Is Backward-Looking
Regulatory frameworks take years to draft and negotiate. Threats move faster than that, so by the time a requirement takes effect it describes the world as it looked when the drafting started. Compliance gets you to yesterday's baseline.
2. Checkbox Mentality
When compliance becomes the goal rather than a byproduct of good security, organisations optimise for audits rather than resilience. Controls are documented but not tested. Policies exist but aren't enforced.
3. Scope Limitations
Regulations apply to defined sectors and product categories. Attackers do not work to the same boundaries. A supply chain attack can arrive through a supplier that falls outside the scope of every regulation you are subject to.
Building Beyond Compliance
The most resilient organisations treat compliance as a foundation rather than a ceiling.
Build the programme around risk, not around the regulation. ISO 27001 or NIST CSF give you a structure that adapts to your context, instead of one that only satisfies an auditor.
Put real money into detection and response. Regulation weights prevention heavily, but breaches happen anyway, and what separates a bad week from a bad year is how quickly you detect, respond and recover.
Test more often than once a year. An annual penetration test tells you about the days it ran. Continuous validation through red teaming, purple teaming and automated attack simulation tells you about the rest of them.
Push into the supply chain. DORA and NIS-2 both emphasise third-party risk. Build supplier security assessments into procurement, then keep monitoring the critical suppliers after the contract is signed.
Culture is the part no regulation can mandate. Awareness cannot be legislated, and security training that stops at the annual e-learning module produces compliance records rather than behaviour change. It has to reach how teams work day to day.
The Bottom Line
DORA and NIS-2 are necessary and, on the whole, welcome. They raise the baseline, they put accountability where it belongs, and they have moved budget that would not otherwise have moved. They are still not sufficient.
Compliance is judged by a regulator, on a schedule everyone knows in advance. Security is judged by an attacker who has not read the directive. An organisation that builds its programme around risk will pass the audit as a side effect. One that builds it around the audit will not necessarily survive the attack.