EU Compliance (NIS2, CRA & DORA)

This refers to whether your organisation develops, manufactures, or distributes products or services that include built‑in digital capabilities. Examples include: smart devices (e.g., smart home products, wearables, connected appliances); embedded systems (e.g., automotive infotainment systems, industrial controllers); cloud‑connected services. If your offerings are entirely analog or mechanical, answer “No.”

Essential Entities: Energy: Electricity, Gas, Oil, District heating and cooling, Transport: Road, Air, Rail, Water transport (including maritime and inland waterways), Banking: Banks and credit institutions, Financial Market Infrastructures: Securities trading venues and related financial infrastructures, Health: Healthcare providers (hospitals, clinics, etc.), Other health-related services, Drinking Water Supply and Distribution or Wastewater Treatment, Digital Infrastructure: Internet Exchange Points (IXPs), Domain Name System (DNS) service providers, Top-Level Domain (TLD) registries, Public Administration: Central and regional (and, where applicable, local) public bodies - basically ANY PUBLIC ENTITY..! Space: Operators of space infrastructure and related ground-based systems

Important Entities: Postal and Courier Services, Waste Management, Manufacturing of Critical Products: Encompassing the production, processing, or distribution of, for example, chemicals, food, pharmaceuticals, and medical devices, Digital Providers: Certain digital service providers, such as online marketplaces, search engines, and cloud computing services, where their operations are deemed critical.

DORA focuses on the financial sector and its support network (including banks, insurance companies, investment firms, payment processors, and ICT service providers for the financial sector).

1. Core Financial Institutions

Banking Sector& Credit Institutions: Banks and similar entities that offer deposit-taking, lending, and related services. Payment Institutions & Electronic Money Institutions: Providers of payment services and issuers of electronic money. Investment Firms: Entities engaged in securities trading, brokerage, asset management, and other investment-related activities (typically regulated under MiFID II). Asset Management (UCITS Management Companies & AIFMs): Firms managing collective investment schemes, whether under the UCITS framework or as Alternative Investment Fund Managers. Insurance and Reinsurance Undertakings: Companies offering insurance products and those that provide risk transfer through reinsurance.

2. Financial Market Infrastructures

Trading Venues: Regulated markets, multilateral trading facilities (MTFs), and organised trading facilities (OTFs). Clearing and Settlement Entities: a) Central Counterparties (CCPs): Entities that clear and settle trades, mitigating counterparty risk. b) Central Securities Depositories (CSDs): Institutions responsible for the safe custody and settlement of securities. Data Registries & Trade Repositories: Bodies that collect and maintain records of derivatives and other over‑the‑counter transactions.

3. ICT Third-Party Service Providers

Additional Notes on “Associated Products”

While DORA’s primary focus is on ensuring that the operational resilience of these institutions is robust against ICT risks, its framework indirectly covers the digital backbone that supports a broad range of financial products. These include, for example: Traditional Financial Products: Deposit accounts, loans, insurance policies, etc. Capital Market Products: Equities, bonds, derivatives, and other structured financial instruments.

This refers to whether your organisation develops, manufactures, or distributes products or services that include built‑in digital capabilities. Examples include: smart devices (e.g., smart home products, wearables, connected appliances); embedded systems (e.g., automotive infotainment systems, industrial controllers); cloud‑connected services. If your offerings are entirely analog or mechanical, answer “No.”

Assess if your offerings are designed to connect to external networks or support remote operations (e.g., internet/cellular connectivity, remote diagnostics, monitoring, or updates).

Determine if your offerings integrate or interact with other digital systems (e.g., through APIs, IoT ecosystems, cross‑platform integration).

‘Essential operations’ are activities critical for societal functioning (e.g., critical infrastructure, emergency services, financial services, public administration, utilities). Answer “Yes” if a cybersecurity incident could disrupt these operations.

Consider if an incident in your offering might trigger cascading effects across interconnected systems (e.g., interdependent IoT networks, centralised software services, critical digital nodes). ”