From NIS2 to DORA: A Security Program That Satisfies Regulators

The regulatory pressure on cybersecurity is no longer a future concern. It's a present-tense enforcement reality. In Europe, NIS2 supervision and sanctions are accelerating. DORA is live for financial services. The two regulations reach different organizations, but they measure the same thing.

The gap between knowing cyber risk is real and having a program that can prove it's managed is what regulators measure now. CIS SecureSuite® is built to close it. 

According to ENISA's 2025 NIS Investments Report, based on a survey of more than 1,000 EU organizations, nearly one in three EU organizations have not conducted a cybersecurity assessment in the past year.

The Regulatory Clock Is Running

NIS2: Personal Liability Is Now the Standard

In Europe, 2026 is the pivotal year where a critical mass of EU member states move from legal transposition of NIS2 to active supervision, audits, and sanctions. NIS2 Article 20 requires management bodies to approve cybersecurity risk management measures and oversee their implementation. Board members and executives can be held liable for cybersecurity failures. Board-level accountability is no longer a governance principle. It is an enforceable legal obligation. 

Despite that, the implementation gap remains significant. Only 16% of in-scope businesses report being fully NIS2-compliant, and another 16% say they lack direction on how to implement it at all. The barriers organizations cite most often: budget, unclear ownership, and no repeatable way to demonstrate progress to regulators who are no longer waiting. 

DORA: Financial Services Has Its Own Deadline

DORA adds a parallel compliance obligation for financial services organizations operating in EU markets, with ICT risk management, incident reporting, and third-party risk documentation now mandatory. Enforcement timelines do not flex for organizations still building their baseline controls.

The frameworks are set. Enforcement is real. The question is whether organizations can operationalize a response before the auditors arrive.

What the Data Does Not Explain

The breach statistics and compliance gaps show what is happening, but they don’t explain the structural decisions, or absence of decisions, that allowed it. Across the EU, organizations struggling to meet regulatory requirements share four recurring gaps.

Fragmented Control Frameworks

Many organizations cannot clearly answer what controls are in place, whether they are working, or how they align to recognized standards. Without regular assessment against a common baseline, compliance becomes a patchwork of one-off responses to individual frameworks.

Limited Governance and Accountability

When cybersecurity is treated as a technical function rather than a board-level business risk, unclear ownership and inconsistent prioritization follow. NIS2 makes that dynamic legally untenable by placing personal liability on board members and executives for cybersecurity failures.

No Repeatable Way to Measure Progress

Many organizations may have implemented some controls but lack a systematic process to assess gaps and track improvement over time. Without that process, they cannot produce the evidence trail auditors and regulators increasingly require.

Difficulty Demonstrating Compliance

Having controls in place is not the same as being able to prove it. Regulators want documented evidence of what is in place and how it is working. Policies and attestations are no longer sufficient.

These gaps share a common root cause: the absence of a repeatable way to define what "secure" looks like, implement controls consistently, measure progress objectively, and demonstrate alignment to the frameworks regulators ask about.

What Good Looks Like in Practice

Organizations that close the execution gap share the same characteristics. They have a clear, independently validated definition of what "secure" means for their environment. They implement controls consistently, not just in policy documents. They measure their posture objectively and demonstrate progress over time. And they map that progress to the frameworks regulators ask about.

Here is how that works in practice.

1. Start With the Global Baseline

The CIS Critical Security Controls® (CIS Controls®) provide a prioritized, independently validated set of security practices with demonstrated impact against the most common attack types. They are designed for organizations of any size and any sector. Implementation Group 1 (IG1), what CIS calls essential cyber hygiene, is the starting point for every organization. According to the CIS Community Defense Model v3.0 (CIS CDM), IG1 defends against 84% or more of attack techniques across the five most prevalent attack categories. It is based on current threat data mapped to real-world attack patterns.

The CIS Controls map to the frameworks regulators are asking about. NIS2, DORA, NIST CSF 2.0, ISO 27001 and more. They are also referenced by the European Telecommunications Standards Institute (ETSI) and recognized by national oversight bodies across Europe. For organizations managing compliance obligations, the CIS Controls provide a single baseline that maps to all of them.

2. Translate Controls Into System-level Action

Knowing which controls to implement is one problem. Knowing exactly how to configure the systems you run is another. The CIS Benchmarks^® provide more than 100 vendor-neutral configuration guides for operating systems, cloud platforms, network devices, and applications. They are developed through a global, consensus-based process and updated continuously. 

3. Automate the Assess-Remediate-Document Cycle

The gap between knowing what good looks like and proving it to a regulator is where most organizations lose time. Manual assessment is not a process.

CIS SecureSuite Membership closes that gap by automating the cycle that manual processes cannot sustain at scale.

CIS-CAT^® Pro Assessor scans systems against the CIS Benchmarks and produces detailed results showing exactly which configuration settings pass, which fail, and by how much. CIS Build Kits automate the configuration changes needed to close the gaps the assessment identifies. The CIS SecureSuite Platform connects assessment results to conformance tracking across time, so when a regulator asks how posture has changed over the past year, the answer comes with data attached.

That cycle, assess, remediate, document, repeat, is what NIS2 auditors are looking for. It is what DORA ICT risk management documentation requires.

4. The Output is Evidence, Not Just Activity

A security program that cannot produce documentation is not a security program in any regulatory sense of the term. CIS SecureSuite Membership produces that documentation as a natural output of the process, not as a separate reporting effort layered on top.

Different Regulations, One Foundation

NIS2 and DORA reach different organizations and answer to different auditors, but they ask for the same thing. Organizations need to state which controls they have in place, prove those controls are working, and show they are improving over time.

The CIS Controls and CIS Benchmarks were built to answer exactly those questions, for any organization, in any regulatory environment. CIS SecureSuite Membership is how organizations implement them at a pace that matches the pressure.

Looking for UK-specific guidance? See UK Cyber Resilience: Closing the Execution Gap.