NIS 2 and DORA: from paper compliance to demonstrable resilience
Regulators now expect more than policies and periodic audits: they require proof that controls work, that third parties are under control and that the organisation can withstand a real attack. Our technologies and managed services help implement, measure and demonstrate these requirements.
Compliance becomes a matter of proof
Yesterday
- Security policies
- Periodic audits
- Paper compliance
With NIS 2 and DORA
- Demonstrable resilience
- Continuous risk management
- Third‑party oversight
- Validation of control effectiveness
- Direct accountability of management
20 objectives and 152 requirements
Governance
- Objectives 1 to 4
- IT inventory, governance framework, ecosystem control, security and HR
Protection
- Objectives 5 to 11
- IT control, architecture, remote access, malware, identity and access, administration
Defence and resilience
- Objectives 12 to 15
- Incidents, continuity and recovery, cyber crises, exercises and tests
Essential entities
- Objectives 16 to 20
- Risk‑based approach, audits, secure configuration, dedicated administration, monitoring
Important entity: 76 applicable requirements. Essential entity: all 152, including objectives 16 to 20 in full. Source: ANSSI, ReCyF v2.5 of 17/03/2026 (working version).
Up to 71% of requirements covered
Share of the ReCyF requirements for an important entity (76 requirements) covered, strongly or partially, by our technologies. Each technology added increases coverage.
Source: SASETY mapping against the ANSSI ReCyF v2.5 (17/03/2026, working version).
Contribution by technology
Number of ReCyF requirements (out of 152) each technology contributes to. The same requirement can be covered by several technologies, so the figures do not add up.
Converged networking and security (SASE)
- Segmentation and filtering (7)
- Encrypted remote access (8)
- Authorised devices (9)
- Administration network (19)
- Detection and isolation (12, 14)
Identity security
- Identities, MFA and reviews (10)
- Administration accounts and directory (11)
- Administration workstations (19)
- MFA for remote access (8)
Email and human factor
- Awareness (4)
- Attachment analysis (9)
- User reports (12)
- Archiving and continuity (13, 14)
Anti-ransomware protection
- Malware and ransomware (9)
- Incident response (12)
- Recovery after encryption (13, 14)
Security validation
- Automated penetration tests (17)
- Exercises and tests (15)
- Password strength (10)
- Action plan follow‑up (2, 16)
In brackets: ReCyF objective number. Source: SASETY mapping against the ANSSI ReCyF v2.5.
From compliance to operational resilience
DORA rests on two major requirements, which largely overlap with NIS 2: governance, risk management, incident reporting, third‑party management, security testing and resilience validation.
Test resilience
- Regular validation of security controls
- Operational resilience testing
- Ability to withstand a real attack
Control third‑party risk
- Cloud providers and software vendors
- IT providers and outsourced critical services
- Contractual requirements for ICT providers
What we bring
- Continuous security validation and evidence for audits
- 24/7 monitoring, incident management and reporting
- Continuity: backup mail service, recovery after ransomware
- DORA addenda for our ICT services
A measured contribution, separate from any certification
Strong
- Once configured, the feature contributes strongly to the technical implementation of the requirement
Partial
- It contributes, covers part of the scope or provides evidence
Outside scope
- The requirement relates to organisation, documents or resources outside the scope