New regulations have come into effect or will soon come into effect in Estonia, which will impose a range of information security obligations on various sectors. Entrepreneurs are struggling to understand where to start and which direction to go. Or whether to run at all.
The DORA regulation – which stands for Digital Operational Resilience Act – has come into force. The NIS2 directive, which sets new, stricter requirements for the cybersecurity of companies providing essential services, has not yet been officially adopted in Estonia. Therefore, future requirements and obligations can only be inferred from the draft amendment to the Cybersecurity Act.
In reality, it is not that complicated, and there are actions that can already be taken for information security and which will certainly not harm any forward-looking company.
First, the requirements of DORA and NIS2 are not so different. Second, complying with the main requirements of these regulations is sensible for any company whose operations depend on information technology and IT service providers (read: all companies).
Let's break down the new obligations.
- DORA (Digital Operational Resilience Act) aims to make financial services more resilient to cyber-attacks and service disruptions.
- NIS2 has a similar goal: to ensure that essential services are available even in the event of a major cyber-attack, power outage etc.
It seems reasonable and quite similar in purpose. But still – do I need to do anything? The correct answer is: yes, you should. And not just to comply with regulatory requirements, but to protect your own business.
The question is only how extensively to undertake the task and how much to formally document.
Risk management and the implementation of information security measures
All information security regulations require companies to manage risks: to know their risks and implement appropriate risk management measures. This sounds reasonable even without legislative pressure, so risk management and the implementation of security measures based on it can be confidently undertaken.
Here, however, there is a significant difference between DORA and NIS2. While DORA does not provide clear guidelines for implementing security measures, NIS2 in Estonia means one of two things: either the Estonian information security standard E-ITS or the international standard ISO 27001 must be implemented. Nevertheless, even if what has been done needs to be reviewed at some point, it will not be wasted if it is based on specific risks.
Risk management related to service providers
While some time ago companies controlled their environment and software themselves and only themselves, now even conservative financial sector companies use many service providers, including for critical services.
Given the increasing risks, both DORA and NIS2 establish additional rules for the use of service providers. These rules include requirements for managing risks related to service providers and additional requirements for contracts.
Incident reporting
Like other standards and frameworks, DORA and NIS2 require the ability to report incidents. This does not only mean the ability to fill out the relevant forms but also the ability to:
- detect incidents,
- manage incidents,
- notify relevant persons of incidents within a fairly short period based on the above.
Business continuity and operational resilience
I dare say that most companies want to operate not only today and tomorrow but also next year and into the next decade. In this case, it is also beneficial to make and test crisis plans.
This does not have to mean dozens of pages of official documents, but rather that you have thought through:
- the situations that may threaten your operations, and
- how to resolve these situations as quickly and with as little damage as possible.
This may mean, for example, agreements (preferably written ones) on what someone will do if there is no electricity, a service does not work, etc., along with the necessary contacts.
None of the measures described above is useless and should already be in place in every company in a way that suits: risk mitigation measures, the ability to detect and quickly resolve incidents, an overview of service providers and related risks as well as crisis plans.
