DORA and NIS2 programmes involve technical, governance and operational obligations; change management supports the required ownership, awareness, third-party coordination and incident-response behaviours.
Treat compliance as operational change
Policy updates and framework mapping are necessary, but not sufficient. Identify who must approve risk, notify incident teams, manage ICT suppliers, participate in tests and maintain evidence. These responsibilities often cross existing organisational boundaries.
DORA applies to defined financial-sector entities and ICT third-party risk arrangements. NIS2 operates through EU member-state implementation across covered sectors. Confirm specific requirements with legal and regulatory owners.
Prepare the people who make decisions
Use role maps and exercises to identify decision rights, escalation times, fallback processes and supplier handoffs. A frontline employee, procurement manager, crisis lead and board member each need different instruction.
Make sure incident reporting channels are credible outside normal working hours and under disruption. Test whether contact lists and approvals work when a key system is unavailable.
Track readiness evidence
Use practical indicators: training coverage for risk-relevant roles, scenario performance, tabletop corrective actions, vendor workflow readiness and confirmed owners. Keep a traceable connection to the organisation’s control framework.
Legal obligations and local implementation change. The safest approach is to pair specialist regulatory interpretation with a disciplined change and reinforcement plan.
Four actions to take away
- Confirm entity and jurisdictional scope
- Map decisions and owners
- Exercise critical handoffs
- Maintain evidence of adoption
Further reading & sources
These authoritative references provide additional technical, regulatory or security context. The analysis and recommendations above are original editorial commentary.