NIS2 and DORA compliance programme
Taking the EU's NIS2 and DORA as the model, you turn scoping, risk management measures, incident reporting, resilience testing and third-party requirements into a compliance programme and compare them with similar rules in other countries.
Level 301 · 17 lessons · 15 practice labs
Lessons
The regulations
- The EU cyber regulation map
- NIS2 scope analysis: sector, size, essential and important entities
- DORA: digital operational resilience in finance
- Comparable regimes: US, UK, Singapore, Türkiye
- Quick task: an applicability decision for five organisations
Requirements
- NIS2 risk management measures
- The DORA ICT risk management framework
- Incident classification and reporting thresholds
- Resilience testing and threat-led penetration testing
- The register of ICT third-party arrangements
- Quick task: classify incidents against reporting thresholds
The programme
- Regulatory gap assessment
- Management body accountability and training
- Supervision, penalties and evidence expectations
- Quick task: an eighteen-month compliance roadmap
Finish
- Reporting to the regulator and the evidence file
- Capstone: a combined NIS2–DORA programme for a payment firm
Practice labs
- Match the regulation to its subject: Match NIS2, DORA, the Cyber Resilience Act and the GDPR to ten subject statements.
- An applicability decision for five organisations: From sector and size data on five organisations, decide NIS2 and DORA scope and entity class, with reasons.
- Compare with comparable regimes: Compare US, UK, Singapore and Türkiye examples with NIS2 on scope, reporting deadline and sanctions.
- Place the measure under its heading: Place fifteen measures under the NIS2 risk management headings.
- Find the missing parts of the DORA framework: Compare a payment institution's ICT risk management document with the DORA components and list the missing parts.
- Assess the resilience testing plan: Assess a bank's annual test plan for scope, independence and the threat-led test requirement and write the gaps.
- Put the reporting deadlines in order: Place the initial notification, intermediate report and final report deadlines for NIS2 and DORA in a table.
- Classify incidents against reporting thresholds: Classify eight incidents as major or not by affected clients, duration, geographic spread and data loss criteria.
- Prepare the initial notification: From the timeline of a payment outage at Yelkovan Bankası, fill in the initial notification form and write the later report dates.
- Fill in the register fields: From five contract summaries, fill in the provider, service, location and criticality fields of the third-party arrangements register.
- Find the contracts behind critical functions: From twenty contracts, identify those supporting critical or important functions and check the mandatory clauses.
- Concentration analysis from the register: From a completed register, extract the critical functions tied to the same provider and the same subcontractor and write a risk note.
- Grade the gaps: Grade fifteen gaps as high, medium or low priority by legal risk and effort.
- An eighteen-month compliance roadmap: From a gap assessment, prepare a roadmap with work packages, owners, dependencies and milestones.
- An evidence file index for the regulator: Prepare an evidence index that ties management body approvals, training records, the risk framework and test reports to each requirement.
About this course
Taking the EU's NIS2 and DORA as the model, you turn scoping, risk management measures, incident reporting, resilience testing and third-party requirements into a compliance programme and compare them with similar rules in other countries.
What you will learn
- The regulations
- Requirements
- The programme
- Finish
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.