Personal responsibility for complying with DORA and NIS2

dora & nis2

The Digital Operational Resilience Act (DORA) and the Network and Information Systems Directive (NIS2) are reshaping how organizations in Europe and beyond manage cybersecurity and operational resilience.

While these regulations demand stronger technical safeguards like Multi-Factor Authentication (MFA) and Zero Trust, they also make one point crystal clear: responsibility for compliance sits at the top with your board of directors and senior leadership.

What is DORA? Who does it apply to?
What are the requirements?
organizations?

What Is DORA and Who Must Comply?

DORA is an EU regulation that strengthens the operational resilience of financial sector entities, including banks, insurers, investment firms, and payment institutions as well as their ICT third-party providers such as:

Cloud service providers
Software vendors
Cybersecurity service companies

Key point: Responsibility for compliance rests with the organization’s governing body. Board members must:

Approve security and operational resilience policies
Allocate sufficient resources for implementation
Oversee and verify compliance on an ongoing basis

Timeline:

Published: December 14, 2022
In force: January 16, 2023
Applicable: January 17, 2025

Who is responsible for complying with NIS2 and DORA

What Is NIS2 and Who Must Comply?

NIS2 has a broader scope, applying to critical and important entities across sectors like:

Energy
Healthcare
Transport
Financial market infrastructure
Public administration

Under NIS2, boards must:

Approve cybersecurity strategies and risk management measures
Monitor and assess compliance
Implement governance that supports Zero Trust principles

Timeline:

Published: December 14, 2022
Implementation deadline: October 17, 2024

Who is responsible for complying with DORA

Consequences of Non-Compliance

NIS2

Key entities: Up to €10M or 2% of global annual turnover
Important entities: Up to €7M or 1.4% of global annual turnover
Additional penalties: Temporary suspension of certification, management bans, and reputational damage
Personal liability for individual board members in certain cases

DORA

Administrative sanctions from national regulators
Binding orders to stop non-compliant practices
Financial penalties and public notices naming the violator
Potential operational restrictions or termination of services
Personal liability for governing body members under national law

Personal Liability Under DORA and NIS2

Both frameworks make it explicit: liability is personal.
Boards cannot delegate full responsibility to the IT department or compliance team. Members of the governing body may be held accountable for failures to implement and oversee required measures.

This means:

Awareness is mandatory board members must understand regulatory obligations.
Oversight is active ongoing monitoring, not one-off approvals.
Decisions must be documented to demonstrate due diligence.

Why Strong Authentication Is Key to Compliance

Both DORA and NIS2 emphasize strong authentication as part of secure identity and access management:

Reduces phishing and credential theft risks
Supports zero-trust security by verifying every access request
Meets regulatory expectations for proportional, risk-based security controls

How Secfense Helps Boards Meet Compliance Obligations

Secfense solutions align with DORA and NIS2 requirements by delivering phishing-resistant MFA and passwordless authentication across the enterprise without costly application rewrites.

Relevant solutions:

Phishing-Resistant MFA – Eliminate passwords as an attack vector
Passwordless for Workforce (IAM) – Secure internal access with passkeys
Passwordless for Customers (CIAM) – Provide secure, frictionless client logins
Legacy App Protection – Add MFA and policies to apps without code changes
Privileged Access & Microauthorizations – Authenticate high-risk actions individually
Secure Remote Access (VPN, Citrix, OWA) – Enforce Zero Trust for external systems
Regulatory Compliance Alignment – Out-of-the-box support for DORA, NIS2, PSD2

📩 Contact Us to Discuss Your Compliance Strategy

What to Expect

A short conversation to understand your requirements and security goals
Discussion of commercial terms for relevant Secfense solutions such as Passwordless IAM, CIAM, Legacy App Protection, or Privileged Access controls
Agreement on next steps proof of concept, contract details, or rollout plan

Who It’s For

Prospects ready to scope a project and discuss budgets
Existing customers expanding Secfense coverage to more systems
Organizations in the decision/purchase stage after reviewing our solution areas

Contact Secfense Today →

Featured Articles

Keep In Touch

We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk

CEO

Sandis

We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director

RKKVC

Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera

Partner

Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures