DORA and NIS2 are here – are you ready for the enforcement era?

DORA and NIS2 are here Are you ready for the enforcement era

The time for preparing is over. DORA and NIS2 are no longer “upcoming regulations.” They’re here, written into law, and enforcement has already started across the EU.

If you work in identity, access management, or cybersecurity, you know this changes the game. It’s not just about having some MFA anymore. It’s about having the right kind of authentication. Phishing-resistant, applied everywhere, and fully auditable.

Where We Are in August 2025

  • DORA has been in force since January 17, 2025. If you’re in the financial sector or part of its supply chain, you’re expected to meet its operational resilience and authentication requirements and prove it during audits.
  • NIS2 has been part of national law in every EU member state since October 2024. Enforcement is starting now, with fines for non-compliance already on the table.

This means the phase of getting ready is over. The focus now is on closing any gaps you didn’t fix before the deadlines and making sure your audit trail is ready at a moment’s notice.

Why Authentication Is in the Spotlight

Both DORA and NIS2 include strong authentication requirements:

  • Multi-factor authentication (MFA) is expected, but only if it’s resistant to phishing attacks.
  • Authentication must cover all systems, not just the easy-to-integrate modern apps.
  • Every login attempt must be logged and easily reportable during audits.

For many organizations, the biggest challenge is legacy systems that were never built to support modern MFA, but that still fall under the same regulatory requirements.

The Problem with “MFA in Name Only”

A lot of companies say, “We already have MFA.” But often:

  • MFA is inconsistent – SMS codes here, push notifications there, hardware keys for just a few critical apps.
  • Gaps remain – older apps or third-party tools with only username/password access.
  • Logs are scattered – making audits slow and painful.

Regulators aren’t just checking for MFA. They’re asking whether it’s phishing-resistant, applied everywhere, and proven in centralized logs.

Join the Webinar: How to Meet DORA and NIS2 Requirements

We’ll cover all of this in detail in our next live webinar:

📅 17 September 2025
🕓 4:00 PM CET | 10:00 AM ET
🎙️ Speakers: Sara Caramitti & Bartosz Cieszewski, Secfense

You’ll learn:

  • The exact MFA requirements under DORA and NIS2
  • What “phishing-resistant authentication” means in practice (and what doesn’t qualify)
  • How to protect all systems, including legacy apps, without rewriting code
  • A real case study of how a leading insurer achieved DORA compliance in weeks

🔗 Register here
🔗 View the LinkedIn Event

Get the Full Special Report

Want to dive deeper right now?
We’ve put together a Special Report breaking down DORA and NIS2’s authentication requirements, timelines, and compliance tips.

📄 Download the report here

Final Thought

DORA and NIS2 are not the end of the story — they’re just the start of a global shift toward stronger, phishing-resistant authentication. Join us on 17 September and make sure your authentication strategy is ready for this new enforcement era.

Featured Articles

Keep In Touch

Read More

DORA and NIS2 are here – are you ready for the enforcement era?

The time for preparing is over. DORA and NIS2 are no longer “upcoming regulations.” They’re here, written into law, and enforcement has already started across…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 2 MIN

How to cut IAM costs and reduce risk without code changes

Passwords continue to be one of the biggest liabilities in enterprise identity and access management (IAM). While much of the conversation focuses on security risks…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 2 MIN

How Secfense enables passkey-based password recovery

In our previous article A Pragmatic Path to Phishing-Resistant Self-Recovery we explained why passwordless doesn’t have to be an all-or-nothing switch. Instead of replacing passwords…
Avatar of Antoni Sikora Antoni Sikora

READ TIME 3 MIN

Testimonials

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures