DORA & NIS2: What’s happening? And why does it matter?

6 nóvember, 2025 - 14:16

Harpa MagnusdottirFounder & CEO

Experts through Hoobla support companies and institutions in strengthening their cybersecurity posture and readiness for DORA and NIS2 compliance.

A Changing World Demands Smarter Solutions.

Two major new EU regulations, DORA (Digital Operational Resilience Act) and NIS2 (Network and Information Security Directive 2), are changing the landscape of cybersecurity and risk management for businesses.

These aren’t just rules for banks and data centers. They affect any company or institution that provides digital services or plays a critical societal role.

What used to be enough before, e.g. havinga reliable hosting provider, using antivirus software and a firewall, no longer cuts it.
Now, companies are expected to:

Show active monitoring and oversight.
Be able to respond to incidents effectively.
Maintain documented response plans that align with international standards like ISO27001 and NIST.

Cyber preparedness and traceability are no longer optional. They’re expected.
But don't just do something at random.

Why it matters

The risks are real. We’ve all seen headlines of cyberattacks bringing companies to a standstill or causing severe reputational damage.
Organizations that delay action are exposed to:

Regulatory fines.
Temporary shutdowns.
Loss of trust and credibility.
Potential liability claims.

The solution: Work with experts through Hoobla

Instead of trying to handle everything internally, companies can get the right experts immediately through Hoobla, either for a temporary project or in a part time position.

Our vetted experts support with:

Readiness assessments and audits for DORA and NIS2.
Technical cybersecurity, including penetration testing, SOC implementation, cloud security.
Legal compliance support, including documentation, contracts, and accountability.
Crisis and risk management planning aligned with ISO27001, NIST and more.

Whether you need temporary consultants, project managers, or even “borrowed cybersecurity experts” to handle a specific area, Hoobla matches you with the right professionals.

Not just for the big players

Small and mid-sized companies must also comply. And the reality is:

-It costs more to react late than to prepare early.-

Hoobla helps you act fast with flexible experts, no long-term hiring required. Our model fits today’s business reality.

DORA & NIS2: Who needs documented processes and procedures?

DORA (Digital Operational Resilience Act)

DORA applies to the financial sector, including:

Banks, insurance firms, pension funds.
Investment firms and payment providers.
FinTech companies dealing with payments, financial data, e-ID, etc.
Tech vendors serving the financial sector, such as cloud providers, IT vendors, and cybersecurity companies.

These companies must have:

Documented cybersecurity procedures.
Formal risk assessments.
Mandatory reporting of security incidents.
Realistic response plans.
Regular audits and testing.

NIS2 (Network and Information Security Directive 2)

NIS2 has a much broader scope than DORA and will affect a large number of Icelandic and European companies.

It applies to entities that provide essential services to society, such as:

Energy providers (electricity, gas, water).
Telecom & data infrastructure companies.
Healthcare & pharma institutions.
Transportation & logistics companies.
IT service providers to critical sectors.
Government bodies & municipalities with digital services.
Financial institutions, many of which fall under both DORA and NIS2.
Larger manufacturing or food companies that impact health/safety.

A company is likely to fall under NIS2 if it:

Has 50+ employees or €10M+ in annual revenue.
Provides a digitally enabled, socially critical service.
Is part of the supply chain for a critical sector.

What does this actually mean?

Companies and institutions must now:

Define and document security risks.
Create clear policies and processes for response and risk management.
Train their employees in cybersecurity awareness.
Ensure clear communication with management and boards.

References & Further Reading

Find a specialist