The Role of MFA in DORA and NIS2 Compliance
In early 2023, two critical regulations—DORA (Digital Operational Resilience Act) and NIS2 (Network and Information Systems Directive)—came into effect, aiming to enhance the cyber resilience of European organizations. Although these regulations do not mandate specific security tools, they emphasize the need for strong authentication mechanisms as part of robust security practices.
DORA and NIS2 outline essential measures for safeguarding corporate resources. While the exact security tools are not specified, both DORA and NIS2 underscore the importance of appropriate strategies, policies, protocols, and ICT tools to secure systems, applications, and databases from unauthorized access.
Why Strong Authentication is Central to DORA and NIS2
Through analysis with experts at the Law4Tech Foundation, it is clear that both DORA and NIS2 recognize multi-factor authentication (MFA) as a crucial security measure. MFA is a foundational tool that significantly reduces risks associated with phishing, social engineering, and unauthorized credential access, making it a key component in meeting these regulatory standards.
DORA: “Financial Entities Must Implement Strong Authentication”
Under DORA, financial entities are explicitly required to implement strong authentication mechanisms. Article 4 of DORA introduces a principle of proportionality, encouraging entities to adjust security according to their size, risk profile, and the complexity of services provided. Larger organizations with higher risk profiles are expected to implement more advanced security measures, while smaller entities may implement proportionate safeguards.
DORA grants each organization some flexibility in defining its security approach. However, national financial supervisory commissions will ultimately determine compliance through inspections, making it essential for organizations to adopt MFA and other strong security controls in alignment with DORA’s expectations.
NIS2’s Broader Approach to Cybersecurity
Under NIS2, organizations across key sectors must adopt cyber hygiene practices and establish a zero-trust framework. Required practices include regular software updates, secure device configurations, network segmentation, identity and access management (IAM), and extensive user awareness training. NIS2 also encourages organizations to use advanced security technologies like AI or machine learning to strengthen defenses against cyber threats.
Within this framework, MFA is recognized as a core security measure, forming the foundation for comprehensive protection. MFA, by requiring multiple verification factors, ensures only authorized users access sensitive applications and systems.
What is Strong Authentication, and How Can Organizations Implement It?
DORA and NIS2 make it clear that companies in critical sectors must adopt strong authentication mechanisms. MFA provides this by requiring at least two factors to verify a user’s identity, which can include:
- Knowledge factors: Something the user knows, like a password or PIN.
- Possession factors: Something the user has, such as a security token or mobile device.
- Inherence factors: Something the user is, including biometrics like fingerprints or facial recognition.
To support compliance, organizations may consider solutions like the User Access Security Broker from Secfense, which enables quick, no-code deployment of MFA across all applications, including legacy systems. With this approach, companies can implement MFA, including FIDO2 passkeys, without altering application code, achieving enterprise-wide coverage in days.
Deadlines for Compliance with DORA and NIS2
The deadlines for compliance are fast approaching: DORA goes into effect on January 17, 2025, and NIS2 on October 17, 2024. Organizations that proactively assess and upgrade their security systems, policies, and technologies now will be best positioned to meet these regulations, while enhancing their cybersecurity resilience.
For further information on DORA and NIS2 requirements, access our comprehensive e-book, “Analysis of DORA and NIS2 Regulations in the Context of EU Cybersecurity”. This report, developed with Law4Tech Foundation, provides in-depth guidance on compliance measures.
Take the Next Step: Schedule a call with a Secfense expert to discuss how strong, passwordless MFA can help your organization comply with DORA and NIS2. Watch our webinar for practical insights on meeting regulatory requirements with scalable, secure MFA solutions.
