Two European texts, two related objectives: reduce the impact of digital incidents<\/strong> and make organizations controllable<\/strong>.<\/p>\n NIS2<\/strong> targets \"essential\" and \"important\" sectors (energy, health, transport, water, digital, public administration, etc.).<\/p>\n<\/li>\n DORA<\/strong> targets the financial sector<\/strong> and its critical ICT providers.<\/p>\n<\/li>\n<\/ul>\n In both cases: governance at management level, risk management, incident preparation, evidence<\/strong>available... and deadlines\/format<\/strong> authorities.<\/p>\n Who's concerned?<\/strong> Essential\" entities with +50 employees\u00a0<\/strong>or\u00a0+10M sales.<\/strong><\/p>\n<\/li>\n What needs to be demonstrated :<\/strong><\/p>\n Governance<\/strong> with explicit management responsibility.<\/p>\n<\/li>\n Risk management<\/strong> (including supply-chain<\/strong>).<\/p>\n<\/li>\n Continuity & response<\/strong> procedures, exercises, proofs.<\/p>\n<\/li>\n Incident notification<\/strong> in controlled deadlines<\/strong> (early warning, notification within 72 h, final report).<\/p>\n<\/li>\n<\/ol>\n<\/li>\n Daily changes :<\/strong> traced decisions, formalized supplier requirements, ready messages for reporting incidents, possible controls by the authority (heavy fines in the event of non-compliance).<\/p>\n<\/li>\n<\/ul>\n Who's concerned?<\/strong> Banks, insurance companies, investment firms, related entities... and certain ICT service providers<\/strong> reviews.<\/p>\n<\/li>\n What needs to be demonstrated :<\/strong><\/p>\n ICT governance<\/strong> by management.<\/p>\n<\/li>\n Incident management<\/strong> with harmonized reporting<\/strong> financial authorities.<\/p>\n<\/li>\n Third-party ICT<\/strong> : register, clauses, monitoring, exit strategy.<\/p>\n<\/li>\n Resilience testing<\/strong> (up to advanced scenarios).<\/p>\n<\/li>\n Continuity<\/strong> & crisis communication.<\/p>\n<\/li>\n<\/ol>\n<\/li>\n Daily changes :<\/strong> formats and channels reporting<\/strong> defined, contractual supplier relationships, testing and exercise schedule.<\/p>\n<\/li>\n<\/ul>\n In practice :<\/strong> a Structured ISMS<\/strong> (such as ISO 27001) covers most of the base; we add the bricks deadlines\/reporting<\/strong> and the third-party layer<\/strong> specific to NIS2\/DORA.<\/p>\n Status & scope<\/strong><\/p>\n Check if\/what applies, map activities, entities and suppliers concerned, identify the competent authority (and its formats).<\/p>\n Governance & proof<\/strong><\/p>\n Appoint people in charge, document how<\/strong> decisions are made, keep records and mark out milestones. periodical magazines<\/strong>.<\/p>\n Incidents & communication<\/strong><\/p>\n Write the instructions for use<\/strong> detection, qualification, who alerts whom, message templates, delivery channels, time clock<\/strong>training sessions.<\/p>\n Third parties & contracts<\/strong><\/p>\n Segment suppliers according to criticality, define minimum requirements<\/strong>integrate clauses<\/strong> (notification, audits, safety, exit plan), and to establish a follow-up<\/strong> regular.<\/p>\n Continuity & testing<\/strong><\/p>\n Realistic Plan B, exercises, resilience testing<\/strong> (more advanced in DORA), logging results and decisions.<\/p>\n NIS2 and DORA are not so much about promises as about facts evidence<\/strong> We're committed to ensuring that our customers' needs are met: clear governance, incidents managed and reported on time, third parties under control, tested continuity. With a ISO 27001<\/strong> and an update on deadlines\/reporting\/tiers<\/strong>You're all set... including the day of the inspection.<\/p>\n You want a NIS2\/DORA blank test<\/strong> and a prioritized roadmap? Let's talk about it.<\/p>","protected":false},"excerpt":{"rendered":" Pourquoi on parle autant de NIS2 et DORA Deux textes europ\u00e9ens, deux objectifs voisins : r\u00e9duire les impacts d\u2019incidents num\u00e9riques et rendre les organisations contr\u00f4lables. NIS2 vise les secteurs \u00ab essentiels \u00bb et \u00ab importants \u00bb (\u00e9nergie, sant\u00e9, transports, eau, num\u00e9rique, administrations, etc.). DORA cible le secteur financier et ses prestataires TIC critiques. Dans les […]<\/p>","protected":false},"author":3,"featured_media":3224,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[22],"tags":[],"class_list":["post-3219","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-pilotage-conformite"],"acf":[],"yoast_head":"\n\n
NIS2 in brief (what the authorities expect of you)<\/h2>\n
\n
\n
DORA at a glance (finance specific)<\/h2>\n
\n
\n
NIS2 vs DORA: same foundations, different accents<\/h2>\n
\n\n
\n \nTheme<\/th>\n NIS2<\/th>\n DORA<\/th>\n<\/tr>\n<\/thead>\n \n Nature<\/td>\n Essential\/Important Sectors Directive<\/td>\n R\u00e8glement finance (applicable as is)<\/td>\n<\/tr>\n \n Management<\/td>\n Explicit role, traceable decisions<\/td>\n Ditto, + responsibility for ICT governance<\/td>\n<\/tr>\n \n Incidents<\/td>\n Early warning, notification, final report<\/td>\n Harmonized reporting + short lead times possible<\/td>\n<\/tr>\n \n Third parties<\/td>\n Supplier\/supply-chain requirements<\/td>\n ICT service providers<\/strong>\u00a0strong contractualization & exit<\/td>\n<\/tr>\n \n Tests<\/td>\n Regular exercises (IR\/BCP)<\/td>\n Resilience testing<\/strong>\u00a0structured, including advanced<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n How to prepare intelligently (without multiplying the number of jobs)<\/h2>\n
Conclusion<\/h2>\n