Types of businesses affected by NIS 2

Public administration, Food, Chemicals, Wastewater, Space, ESN linked to an entity that must comply with NIS 2, Manufacturing, DNS providers; Digital providers (including marketplaces, search engines, social networking services), Waste management, Digital infrastructure for public administrations and space, Pharmaceuticals, Service providers operating for companies that must comply with NIS 2 requirements, Public electronic communications networks, Research, Postal and shipping services, Companies managing TLD domain name registries, Transport.

How to prepare for the NIS2 directive?

The ENISA report provides technical guidance to support the implementation of the NIS2 Directive for several types of entities in the NIS2 digital infrastructure, ICT service management and digital providers sectors. The cybersecurity requirements for these entities are defined at EU level by Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024. ENISA’s guidance offers practical advice, examples of evidence, and mappings of security requirements to help companies implement the regulation.GCTI's catalog of trusted cloud services systematically publishes and verifies labels, certifications (ISO), and qualifications in terms of information system security. DORA is still checked and we will soon add NIS 2 to this list.

Supply chain security improvements

In article 21.2.d, NIS2 now addresses supply chain security, particularly the relationships between each entity, organization, and their suppliers and service providers.This also means that IaaS, PaaS, and SaaS solutions will also have to undergo security checks. A subcontractor and/or SaaS provider that supplies cloud infrastructure, platforms, and applications as a service to an essential entity (EE) or important entity (IE) will therefore have to adapt its security measures, which will be set out in a contract.

The sectors affected by the DORA regulation

You are particularly concerned by DORA if your organization is one of the 21 types of entities covered by Article 2, namely: Credit institutions, payment institutions, electronic money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, alternative investment fund managers; management companies, data reporting service providers; insurance and reinsurance undertakings; insurance intermediaries, reinsurance intermediaries, and ancillary insurance intermediaries; occupational pension institutions; credit rating agencies; administrators of critical benchmarks; crowdfunding service providers; securitization repositories; third-party ICT and cloud service providers.

I am a cloud service provider: Does the DORA regulation apply to me?

Article 28 of the regulation is explicit on this point: Financial sector players are responsible for their external service providers, namely third-party ICT and cloud service providers. Financial sector players falling within the scope of DORA will therefore require their cloud service providers to comply with the regulation. These providers will now be responsible for managing their information systems at their headquarters. They will be held accountable for the compliance of their own third parties with the DORA regulation. “Critical” providers under the new regulation will be monitored by a supervisory authority that will assess their compliance through document checks or on-site inspections. Similarly, contracts with financial institutions will have to be reinforced with clauses relating to DORA compliance.

To get ready for the impact of NIS 2 and DORA, cloud service providers that already have a framework that complies with ISO 27000 (organizational controls, personnel controls, physical controls, and technical controls) will be better able to align with the new provisions of the national directive and/or European regulation.

NIS 2 and DORA: What impact will they have on cloud service providers?

Jan 23

5 min read

Updated: Jan 26

The number of entities that will be subject to NIS 2 is estimated to be 10 to 30 times greater than those affected by NIS 1. This directive has not yet been transposed in all European countries. The DORA regulation on cybersecurity in the financial sector, in force since January 2025, is already impacting third-party cloud and ICT providers.

Want to read more?

Subscribe to gcti.cloud to keep reading this exclusive post.

Subscribe Now