Compliance
Cybersecurity compliance: NIS2, DORA and verifiable sovereignty
Updated on .
NIS2 and DORA require the organisations in scope to govern their cyber risk, address their vulnerabilities, test their resilience, report incidents and keep control of their suppliers. Sovereignty adds a further question: who can access your data, and under which law. BEAROPS helps you prepare, document and demonstrate your compliance. Each framework has its own dedicated page.
- Compliance support, not a guarantee
- French software vendor
- Evidence, not fear
NIS2, DORA, sovereignty: where to start
Three frameworks now shape the cyber compliance of European organisations. NIS2 sets a security baseline for many sectors, DORA governs the digital resilience of the financial sector, and sovereignty raises the question of control over your data. Each page sets out the scope, the obligations and the evidence expected.
-
NIS2
NIS2 complianceThe European NIS2 Directive extends cybersecurity obligations to 18 sectors. Who is in scope, what it requires and an implementation plan.
-
DORA
DORA complianceThe DORA Regulation has applied to the financial sector since 17 January 2025. Its five pillars, resilience testing and ICT third-party risk.
-
Sovereignty
cybersecurity sovereigntyHosting, applicable law, subcontractors, reversibility: the verifiable criteria of sovereignty, and how BEAROPS applies them.
Further reading: NIS2 supplier checklist (article in French).
Which requirement, which page, which support
The obligations of NIS2 and DORA overlap on several points: control of suppliers, vulnerability management, testing and evidence. The table below shows, for each requirement, the page that explains it and the BEAROPS component that can help you meet it.
| Requirement | Page that explains it | BEAROPS component that helps |
|---|---|---|
| Supply chain security (NIS2) and ICT third-party risk (DORA) | NIS2 compliance , DORA compliance | Bearlink TPRM : supplier risk assessment and monitoring |
| Vulnerability and exposure management | NIS2 compliance | Beareye CTEM : discovery, prioritisation and tracking of exposure |
| Resilience testing (DORA, Articles 24 and 25) | DORA compliance | Pentest and Red Team services |
| Risk governance and evidence of implementation | NIS2 compliance , DORA compliance | Unified view of exposure and executive reporting ( Beareye ) |
| Control over data access and applicable law | cybersecurity sovereignty | Hosted in France on OVHcloud infrastructure certified ISO/IEC 27001. |
- Our penetration tests and Red Team exercises fit into your digital operational resilience testing programme under Articles 24 and 25 of DORA.
- BEAROPS helps you prepare, document and demonstrate your compliance.
What BEAROPS does not do
Being clear about our limits is part of compliance. BEAROPS publishes software and carries out technical testing; we provide neither legal advice nor compliance certificates. To determine your status or interpret a legal text, rely on your legal counsel and the competent authorities.
Sources and references
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
- Regulation (EU) 2022/2554 (DORA), EUR-Lex
- MonEspaceNIS2, ANSSI (in French)
Sources consulted on . Report an error: contact+site@bearops.fr
Frequently asked questions
What is the difference between NIS2 and DORA?
NIS2 is a directive that sets a cybersecurity baseline for many sectors and must be transposed into national law. DORA is a regulation directly applicable to the financial sector, focused on digital operational resilience. For cyber risk management, DORA applies to financial entities as a sector-specific Union legal act within the meaning of Article 4 of NIS2: a financial entity should therefore look at DORA first.
Can BEAROPS make me compliant with NIS2 or DORA?
No. No tool or service makes you compliant: compliance results from an organisation, measures and evidence for which you remain responsible. BEAROPS helps you prepare, document and demonstrate your compliance, with exposure tools, supplier risk tools and technical testing.
How are compliance and sovereignty related?
They meet on control over your suppliers and your data. NIS2 and DORA require you to assess the risk posed by your providers; sovereignty raises the question of applicable law and of who may access your data. Our sovereignty page details the verifiable criteria we apply.
Where should I start if I do not know whether I am in scope?
Start by checking your status: ANSSI, the French national cybersecurity agency, provides a dedicated NIS2 portal, and DORA covers the financial entities listed in the regulation. Then read the page for the framework that applies to you. An assessment with a BEAROPS expert can complement this analysis without replacing legal advice.
Take stock of your obligations
A BEAROPS expert helps you identify the frameworks that apply to you, measure your technical gaps and gather useful evidence, without taking the place of your legal counsel.