Two years can feel like a long time, but it's really
not. The Beatles
released Help!, Rubber
Soul, Revolver and Sgt.
Pepper's Lonely Hearts Club Band in 21
months. Shackleton spent about the same amount of time
floating around in the Weddell Sea.
Businesses in the European Union now face their own two-year
voyages, thanks to the entry into force of two cybersecurity laws
that will apply to a wider range of industries than ever before and
significantly increase their security and incident reporting
obligations.
The laws entered into force on Monday: one, a regulation —
the Digital Operational Resilience Act, or “DORA”
— that will be directly effective across member states from
17 January 2025; and the other, a directive — the NIS2
Directive, or “NIS2” — that gives member states
more wiggle room as to how the law should be set out in their
country by 18 October 2024. This article only considers the
EU position, but the UK plans to introduce similar legislation
