DORA, NIS2 and the Critical Entities Resilience Directive, and what they mean for business continuity programmes.
Applies directly in every member state from 17 January 2025. It sets uniform requirements for ICT risk management, incident reporting, digital operational resilience testing and ICT third-party risk, including ICT business continuity and recovery plans. Critical ICT providers to the sector come under EU oversight.
DORA on EUR-Lex ↗The EU cyber security directive for a wide range of sectors. Its risk-management measures include business continuity, such as backup management, disaster recovery and crisis management. Member states had to transpose it by 17 October 2024, and many were late, so national rules vary.
NIS2 on EUR-Lex ↗Covers physical and all-hazards resilience for sectors such as energy, transport, health and water. Member states had to identify their critical entities by 17 July 2026; those entities must assess risks and take measures to prevent, withstand and recover from disruption.
CER on EUR-Lex ↗The international management-system standard for business continuity. It helps join up DORA, NIS2 and CER obligations in one programme.
ISO 22301 overviewBCI CBCI certification training and specialist courses in business continuity, incident response, crisis management and resilience.
Tailored awareness and role-based training for leadership, continuity teams, business owners and operational staff.
A structured review of your BCM programme against the central-bank or sector rules that apply to you, with a prioritised plan to close the gaps.
Scenario-based exercises, plan validation, programme reviews, maturity assessments and continual-improvement support.
Business continuity standards, central-bank rules and other regulatory requirements for the countries ADVOX supports.