NIS2 – an update of the EU’s Network and Information Security Directive – seeks to enhance the cybersecurity level and resilience of EU member states. Compared to the original NIS, it significantly increases risk management, corporate accountability, business continuity, and reporting requirements. NIS2 became law in all EU member states on 17 October 2024, so affected organizations must take action to avoid fines and other penalties. This guide describes the 10 minimum cybersecurity requirements mandated by NIS2 and provides tips to simplify NIS2 compliance. Citation: Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

Who does NIS2 apply to, and what are the consequences for noncompliance?

NIS2 applies to organizations providing services deemed “essential” or “important” to the European economy and society. Essential Entities (EE) generally have at least 250 employees, annual turnover of €50 million, or balance sheets of €43 million. Essential sectors include:

• Energy
• Transport
• Finance
• Public administration
• Health
• Space
• Water supply (drinking & wastewater)
• Digital infrastructure (e.g., cloud computing providers)

Important Entities (IE) generally have at least 50 employees, annual turnover of €10 million, or balance sheets of €10 million. Important sectors include:

• Postal services
• Waste management
• Chemicals
• Research
• Food
• Manufacturing (e.g., medical devices and other equipment)
• Digital providers (e.g., social networks, online marketplaces)

The NIS2 Directive outlines three types of penalties for noncompliance: non-monetary remedies, administrative fines, and criminal sanctions. Non-monetary remedies include things like compliance orders, binding instructions, security audit orders, and customer threat notification orders. Financial penalties for Essential Entities max out at €10 million or 2% of the global annual revenue, whichever is higher; for Important Entities, the maximum is €7 million or 1.4% of the global annual revenue, whichever is higher. NIS2 also directs member states to hold top management personally responsible for gross negligence in a cybersecurity incident, which could involve:

• Ordering organizations to notify the public of compliance violations
• Publicly identifying the people and/or entities responsible for the violation
• Temporarily banning an individual from holding management positions (EEs only)

Even the nonfinancial penalties of NIS2 noncompliance can affect revenue by causing reputational damage and potential lost business, so it’s crucial for IEs and EEs to be prepared when this directive takes effect in their state.

10 Minimum requirements for NIS2 compliance

The NIS2 directive requires essential and important entities to take “appropriate and proportional” measures to manage security and resilience risks and minimize the impact of incidents. It mandates an “all-hazards approach,” which means creating a comprehensive business continuity framework that accounts for any potential disruptions, whether they be natural disasters, ransomware attacks, or anything in between. Organizations must implement “at least” the following requirements as a baseline for NIS2 compliance (click links for more info):

1. Risk analysis and information system security policies

Organizations must create and update comprehensive policies covering cybersecurity risk analysis and overall IT system security practices. These policies should cover all the topics listed below and include specific consequences and/or corrective measures for failing to follow the outlined processes.

2. Security incident handling

Entities must implement incident-handling tools and practices to help accelerate resolution and minimize the impact on end users and other essential or important services. This includes mechanisms for identifying problems, triaging according to severity, remediating issues, and notifying relevant parties. NIS2 outlines a specific timeline for reporting significant security incidents to the relevant authorities:

• Within 24 hours – Entities must provide an early warning indicating whether they suspect an unlawful or malicious attack or whether it could have a cross-border impact.

• Within 72 hours – Entities must update the relevant authorities with an assessment of the attack, including its severity, impact, and indicators of compromise.

• Within one month – Organisations must submit a final report including a detailed description of the incident, the most likely root cause or type of threat, what mitigation measures were taken, and, if applicable, the cross-border impact. If the incident is still ongoing, entities must submit an additional report within one month of resolution.

3. Business continuity and crisis management

Essential and important entities must establish comprehensive business continuity and crisis management strategies to minimize service disruptions. These strategies should include redundancies and backups as part of a resilience system that can keep operations running, if in a degraded state, during major cybersecurity incidents. It’s also crucial to maintain continuous access to management, troubleshooting, and recovery infrastructure during an attack.

4. Supply chain security

Organizations must implement supply chain security risk management measures to limit the risk of working with third-party suppliers. These include performing regular risk assessments based on the supplier’s security and compliance history, applying zero-trust access control policies to third-party accounts, and keeping third-party software and dependencies up-to-date.

5. Secure network and IT system acquisition, development, and maintenance

Entities must ensure the security of network and IT systems during acquisition, development, and maintenance. This involves, among other things, inspecting hardware for signs of tampering before deployment, changing default settings and passwords on initial startup, performing code reviews on in-house software to check for vulnerabilities, and applying security patches as soon as vulnerabilities are discovered.

6. Cybersecurity and risk-management assessments

Organizations must have a way to objectively assess their cybersecurity and risk-management practices and remediate any identified weaknesses. These assessments involve identifying all the physical and logical assets used by the company, scanning for potential threats, determining the severity or potential impact of any identified threats, taking the necessary mitigation steps, and thoroughly documenting everything to streamline any reporting requirements.

7. Cybersecurity training

Essential and important entities must enforce cybersecurity training and basic security hygiene policies for all staff. This training should include information about the most common social engineering attacks, such as email phishing or vishing (voice phishing), compliant data handling practices, and how to securely create and manage account credentials.

8. Cryptography and encryption

NIS2 requires organizations to use cryptography to protect systems and data from tampering. This includes encrypting sensitive data and communications when necessary.

9. User access control and asset management

Entities must establish policies and procedures for employees accessing sensitive data, including least-privilege access control and secure asset management. This also includes mechanisms for revoking access and locking down physical assets when users violate safe data handling policies, or malicious outsiders compromise privileged credentials.

10. Multi-factor authentication (MFA) and encrypted communications

The final minimum requirement for NIS2 compliance is using multi-factor authentication (MFA) and continuous authentication solutions to verify identities, as described above. Additionally, entities must be able to encrypt voice, video, text, and internal emergency communications when needed.

How ZPE streamlines NIS2 compliance

EU-based entities classified as essential or important have limited time to implement all the security policies, practices, and tools required for NIS2 compliance. Using vendor-neutral, multi-purpose hardware platforms to deploy new security controls can help reduce the hassle and expense, making it easier to meet the October deadline. For example, a Nodegrid serial console from ZPE Systems combines out-of-band management, routing, switching, cellular failover, SSL VPN and secure tunnel capabilities, and environmental monitoring in a single device. The vendor-neutral Nodegrid OS supports GuestOS and containers for any third-party software, including next-generation firewalls (NGFWs), Secure Access Service Edge (SASE), automation tools like Puppet and Ansible, and UEBA. Nodegrid devices have strong hardware Roots of Trust with TPM 2.0, selectable encrypted cryptographic protocols and cipher suite levels, and configuration checksumTM. Plus, Nodegrid’s Gen 3 OOB creates the perfect foundation for infrastructure isolation, resilience systems, and isolated recovery environments.

Looking to Upgrade to a Nodegrid serial console?

Looking to replace your discontinued, EOL serial console with a Gen 3 out-of-band solution? Nodegrid can expand your capabilities and manage your existing solutions from other vendors. Click here to learn more!

The European Union’s Digital Operational Resilience Act (DORA) creates a regulatory framework for information and communication technology (ICT) risk management and network resilience. It entered into EU law on 16 January 2023 and took effect on 17 January 2025, applying to any firm operating within the European financial sector. This guide outlines the technical requirements for DORA compliance and provides tips and best practices to streamline implementation.

Citation: Digital Operational Resilience Act (DORA)

Which organizations does DORA affect, and what are the consequences of non-compliance?

DORA applies to financial entities operating in the European Union, including:

• Financial services
• Payment institutions
• Crypto-asset service providers
• Crowdfunding service providers
• Investment firms
• Insurance companies
• Data analytics and audit services
• Fintech companies
• Trading venues
• Credit institutions
• Credit rating agencies

Crucially, DORA also applies to third-party digital service providers that work with financial institutions, such as colocation data centers and cloud service providers.

Once DORA takes effect, each EU state will designate “competent authorities” to enforce compliance. Each state determines its own penalties, but potential consequences for non-compliance include fines, remediation, and withdrawal of DORA authorization.

ICT service providers (such as cloud vendors) labeled “critical” by the European Commission face additional oversight and non-compliance penalties, including fines of up to 1% of the provider’s average daily worldwide turnover the previous business year. Overseers can levy fines on a provider every day for up to six months until compliance requirements are met. These steep penalties make it essential for service providers to ensure their systems and processes are DORA-compliant.

What are DORA’s technical requirements?

ICT risk management

DORA requires financial institutions to develop a comprehensive ICT risk management framework containing strategies and tools for business resilience, recovery, and communication. In addition to written policies and documented procedures, financial entities must implement technology such as security hardware and software, redundancies and backups, and resilience systems. Best practices for DORA-compliant risk management technologies include:

• Control plane/data plane separation
• Isolated recovery environments

ICT third-party risk management

Financial organisations in the EU must manage the risk of working with third-party vendors to prevent supply chain attacks such as the MOVEit breach. ICT third-party risk management (TPRM) involves performing vendor due diligence to validate compliance with security standards and ensuring contractual provisions are in place to hold vendors accountable for security failures. On the technical side, financial entities should implement security policies and controls to limit third-party access and use monitoring tools that detect vulnerabilities, apply patches, and identify suspicious account behavior. Best practices for DORA-compliant TPRM technologies include:

• Automated patch management
• AIOps security monitoring

Digital operational resilience testing

DORA requires financial entities to establish a resilience testing program to validate their security defenses, backups, redundancies, and recovery systems once per year. Examples of resilience tests include vulnerability scans, network security assessments, open-source software analyses, physical security reviews, penetration testing, and source code reviews. Financial entities deemed “critical,” as well as their critical ICT providers, must also undergo threat-led penetration testing (TLPT) every three years. DORA stipulates that these tests be performed by independent parties, though they can be internal so long as the organization takes steps to eliminate any conflict of interest. Technical best practices include:

• Control plane/data plane separation

ICT incident reporting

DORA streamlines and consolidates the incident reporting requirements that are currently fragmented across EU states. The takeaway from this section is a requirement for financial firms to submit a root cause report within one month of a major incident. Technical best practices for meeting this requirement involve using AIOps for:

• Anomaly detection
• Incident management
• Root-cause analysis (RCA)

Information sharing

This is less of a requirement than a suggestion, but DORA both allows and encourages financial institutions to share cyber threat information within the community to help raise awareness and mitigate risks. Best practices involve using (anonymized) logs from some of the technologies mentioned above, such as UEBA and AIOps.

Oversight of critical third-party providers

DORA requires “critical” digital service providers to follow the same compliance rules as the financial institutions they work with. Regulators may deem a provider critical if a large number of financial entities rely on them for business continuity or if they are difficult to replace/substitute when a failure occurs. Any cloud vendors, colocation data centers, or other digital service providers working in the EU’s financial sector should prepare for DORA by implementing:

• Control/data plane separation
• Isolated recovery environments
• Automated patch management
• AIOps

Best practices for DORA compliance

Some of the technologies that can help simplify DORA compliance for financial institutions and critical service providers include:

Control/data plane separation

Separating the data plane (i.e., production network traffic) from the control plane (i.e., management and troubleshooting traffic) simplifies DORA compliance in two key ways:

1. It isolates the management interfaces used to control ICT systems, making them inaccessible to malicious actors who breach the production network and aiding in resilience.
2. It prevents resource-intensive automation, security monitoring, and resilience testing workflows from affecting the speed or availability of the production network.

The best practice for control and data plane separation is to use Gen 3 out-of-band (OOB) serial consoles, such as the Nodegrid product line from ZPE Systems. Gen 3 OOB provides a dedicated network for management traffic that doesn’t depend on production network resources, ensuring remote teams always have access, even during outages or ransomware attacks. It’s also vendor-neutral, allowing administrators to deploy third-party monitoring, automation, security, troubleshooting, and testing tools on the isolated control plane. Gen 3 OOB helps financial institutions and ICT service providers meet resilience and testing requirements cost-effectively.

Isolated recovery environments

Ransomware continues to be one of the biggest threats to resilience, with ransomware cases increasing by 73% in 2023 despite heightened awareness and additional cybersecurity spending. Preventing an attack may be nearly impossible, and full recovery often takes weeks due to the high rate of reinfection. The best way to reduce recovery time and meet DORA resilience requirements is with an isolated recovery environment (IRE) that’s fully separated from the production infrastructure.

An IRE contains systems dedicated to recovering from ransomware and other breaches, where teams can rebuild and restore applications, data, and other resources before deploying them back to the production network. It uses designated network infrastructure that’s completely separate from the production environment to mitigate the risk of malware reinfection. It also contains technologies like Retention Lock, role-based access control, and out-of-band management so teams can quickly and safely recover critical services and reduce DORA penalties.

Automated patch management

Cybercriminals often breach networks by exploiting known vulnerabilities in outdated software and firmware, as happened with 2023’s Ragnar Locker attacks. For large financial institutions and critical ICT providers, manually tracking and installing patches for all the third-party hardware and software used across the organization is too difficult and time-consuming, leaving potential vulnerabilities exposed for years. The best practice for meeting DORA’s third-party risk management requirement is to use an automated, vendor-agnostic patch management solution.

Automatic patch management tools discover all the software and devices used by the organization, monitor for known exploited vulnerabilities, and notify teams when vendors release updates. They centralize patch management for the entire network to simplify TPRM and aid in DORA compliance.

AIOps

AIOps uses artificial intelligence technology to automate and streamline IT operations. AIOps collects and analyses all the data generated by IT infrastructure, applications, monitoring tools, and security solutions to help identify significant events and make “intelligent” recommendations. AIOps helps with DORA compliance by providing:

• Anomaly detection – Artificial intelligence analyses logs and detects outlier data points that could indicate an in-progress data breach or other problematic event.
• Incident management – AIOps automatically generates, triages, and assigns service desk tickets to the appropriate team for resolution, significantly accelerating incident response.
• Root-cause analysis – AIOps combs through all the relevant logs to determine the most likely cause of adverse events, making it easier to meet DORA’s root-cause reporting requirements.

How ZPE streamlines DORA compliance

The Nodegrid out-of-band management platform from ZPE Systems helps financial institutions and critical service providers meet DORA resilience requirements without increasing network complexity. Vendor-neutral Nodegrid serial consoles and integrated edge services routers deliver control plane isolation, centralized infrastructure patch management, and Guest OS/container hosting for third-party security, recovery, and AIOps tools. The Nodegrid platform provides a secure foundation for an isolated recovery environment that contains all the technology needed to get services back online and stay DORA compliant.

Download our 3 Steps to Ransomware Recovery whitepaper to learn how to improve network resilience with Nodegrid.
Download the Whitepaper

See how Nodegrid helped one of the EU’s largest banks meet modern security and compliance requirements.
Read the case study

Looking to replace your discontinued, EOL serial console with a Gen 3 out-of-band solution?

Looking to replace your discontinued, EOL serial console with a Gen 3 out-of-band solution? Nodegrid can expand your capabilities and manage your existing solutions from other vendors.

Click here to learn more!

SD-WAN applies software-defined networking (SDN) principles to wide area networks (WANs), which means it decouples networking logic from the underlying WAN hardware. SD-WAN management involves orchestrating and optimizing software-defined WAN workflows across the entire architecture, ideally from a single, centralized platform. This SD-WAN management guide explains how this technology works, the potential benefits of using it, and the best practices to help you get the most out of your SD-WAN deployment.

How does SD-WAN management work?

A typical WAN architecture uses a variety of links, including MPLS, wireless, broadband, and VPNs, to connect branches and other remote locations to enterprise applications and resources. SD-WAN is a virtualized service that overlays this physical architecture, giving software teams a unified software interface from which to manage network traffic and workflows across the enterprise. SD-WAN management decouples network control functions from the gateways and routers installed at remote sites, preventing administrators from having to manage each one individually. It also reduces the reliance on manual CLI rules and prompts, which are time-consuming and prone to human error, allowing teams to deploy policies across an entire network at the same time.

SD-WAN can also use multiple connection types (including 5G LTE, MPLS, and fiber) interchangeably, switching between them as needed to ensure optimal performance. Plus, SD-WAN management enables organizations to use virtualized and cloud-based security technologies (such as SASE) to secure remote traffic to SaaS, web, and cloud resources. This allows organizations to reduce traffic on expensive MPLS links by utilizing less-costly cellular and public internet links to handle cloud-destined traffic.

The benefits of SD-WAN management

Cost reduction

MPLS links provide a secure connection between branches and centralized data center resources, but the bandwidth is far more expensive than fiber or cellular. SD-WAN reduces branch bandwidth costs by using less expensive channels for traffic that’s destined for resources online and in the cloud, reserving MPLS bandwidth for enterprise traffic alone.

Improved performance

To optimize the performance of a traditional WAN, teams must create specific routing, bandwidth utilization, and load-balancing rules for each branch and appliance, and hope these policies adequately predict and resolve any potential issues. SD-WAN management uses technologies like application awareness and guaranteed minimum bandwidth to automatically optimize network performance.

Automation & orchestration

By decoupling network control functions from the underlying WAN hardware, SD-WAN enables automatic device deployments, load balancing, failover, and intelligent routing. Teams can orchestrate automated workflows across the entire network architecture from a centralized software platform, to make deployments and configuration changes more efficient.

Enhanced security

Branch networks often suffer from security gaps due to the difficulty in extending enterprise security policies and controls to remote sites. Securing branch traffic usually means backhauling all traffic through the data center’s firewall, eating up expensive MPLS bandwidth and introducing latency for the rest of the enterprise. Some organizations opt to deploy security appliances at each branch site, which is costly and gives network administrators more moving parts to manage. 

SD-WAN enables the use of cloud-based security solutions like SASE and Zero Trust Edge that extend enterprise security defenses to branch network traffic without backhauling or additional hardware. SD-WAN automatically identifies traffic destined for web or cloud resources and routes it through the cloud-based security stack across less-expensive internet links, saving money and reducing management complexity while improving branch security.

How to get the most out of your SD-WAN deployment

There are a variety of SD-WAN deployment models, each of which solves a different WAN problem, so it’s important to assess your organization’s requirements and capabilities to ensure you build an architecture that meets your needs. It’s also critical to consider the scalability, adaptability, security, and resilience of your SD-WAN deployment to prevent headaches down the road. 

For example, using a vendor-neutral platform like Nodegrid to host SD-WAN allows you to easily expand your branch networking capabilities with third-party software for automation, security, monitoring, troubleshooting, and more without deploying additional hardware, allowing you to easily scale and adapt to changing business requirements. Nodegrid also consolidates branch functions like routing, switching, out-of-band serial console management, SD-WAN management, and SASE network security in a single device for cost-effective branch deployments. Plus, Nodegrid enables isolated management infrastructure that’s resilient to threats and provides a safe recovery environment from ransomware attacks and network failures. 

Ready to get started on your SD-WAN deployment?

Nodegrid unifies control over mixed-vendor hardware and software solutions across the enterprise network architecture for efficient, streamlined SD-WAN management. Request a free demo to learn more.

Request a Demo