{"id":9491,"date":"2025-02-21T15:40:49","date_gmt":"2025-02-21T14:40:49","guid":{"rendered":"http:\/\/explegal.local\/compliance-nis2-dora-en\/"},"modified":"2026-07-08T14:54:43","modified_gmt":"2026-07-08T12:54:43","slug":"compliance-nis2-dora-en","status":"publish","type":"post","link":"https:\/\/explegal.it\/en\/compliance-nis2-dora-en\/","title":{"rendered":"Compliance becomes more complex only if approached passively!"},"content":{"rendered":"

\u00a0<\/span><\/p>\n

At one time, compliance<\/strong> referred solely to workplace safety. Then came privacy<\/strong> regulations, corporate criminal liability<\/strong>, cybersecurity<\/strong>, and its various facets such as resilience, business continuity, and more. Meanwhile, sector-specific regulations began to emerge: for financial companies, insurance firms, energy, transportation, healthcare, and IT services.\u00a0<\/span><\/p>\n

In short, compliance is no longer a mere task to be checked off to mitigate the risk of sanctions or a document to showcase; today, compliance means having a clear understanding of interactions, sector-specific requirements, and business objectives, which can never be overlooked.<\/span><\/p>\n

\u00a0<\/p>\n

The NIS2 EU Directive<\/strong><\/span><\/p>\n

In recent months, many companies and public administrations have been \u201cconcerned\u201d with the so-called NIS2 Directive.<\/span><\/p>\n

The NIS2 Directive (Directive (EU) 2022\/2555) is the European regulation that strengthens the cybersecurity framework within EU Member States, imposing stringent obligations on cybersecurity, risk management, and incident notification.<\/span><\/strong><\/span><\/p>\n

In Italy, NIS2 has been implemented through Legislative Decree No. 138 of 2024 and applies to numerous sectors, including energy, transportation, logistics, healthcare, and IT services, among others.<\/span><\/strong><\/span><\/p>\n

The primary objective of NIS2 is to enhance resilience and cybersecurity in strategic sectors by expanding the scope of the previous directive and introducing stricter requirements for businesses and public administrations.<\/span><\/p>\n

The NIS2 sets a very short deadline with respect to the drafting of this note, in fact, whoever is the recipient of the regulation must nominate the cybersecurity contact point (internal or external), register on the ACN (National Cybersecurity Agency) portal, by 28 February 2025, and, subsequently, implement a series of obligations of a certain complexity which presuppose having conducted a preventive “gap analysis”.<\/span><\/p>\n

This means a significant workload for CEOs, CISOs, CIOs, IT Managers, DPOs, and multiple other corporate roles and departments.<\/span><\/p>\n

\u00a0<\/span><\/p>\n

The DORA regulation<\/strong><\/span><\/p>\n

Another regulation that is dominating discussions in recent months is DORA.<\/span><\/p>\n

The Digital Operational Resilience Act (DORA), formally Regulation (EU) 2022\/2554, is an European Union regulation that came into force on January 16, 2023 and will apply in Italy from January 17, 2025<\/strong>, to:<\/span><\/p>\n