Guides
Written for the people who have to implement this, not for search engines. Every factual claim links to the legal text or standard it comes from, so you can verify it rather than trust us.
Pillar guide · 12 min read
NIS2, DORA and the Cyber Resilience Act reach into the same place: how you build, test, document and maintain software. What the three converge on, the evidence an auditor actually asks for, a 90-day implementation sequence, and the five mistakes that cost European teams a year.
Read the guideDirective (EU) 2022/2555
NIS2 and software security
What NIS2 requires from software teams: supply chain security, secure development and maintenance, vulnerability handling — and the evidence that proves it.
Regulation (EU) 2022/2554
DORA and application security
What DORA means for software delivery in financial entities and their ICT providers: ICT risk management, resilience testing, third-party risk and the evidence expected.
Regulation (EU) 2024/2847
Cyber Resilience Act and SBOM
Deadline · 11 September 2026
The CRA's vulnerability and incident reporting obligations apply from 11 September 2026: 24-hour early warning, 72-hour notification. What manufacturers must do — SBOM, vulnerability handling, secure-by-design.
Free brief
One email with the pillar guide, the NIS2, DORA and CRA briefings and all executive whitepapers. No gate on the content itself — it is all free to read on this site; this just puts it in your inbox for when you need it.
We send this once because you asked. You are not added to any marketing list and your address is not stored in a database — see our Privacy Statement.
Start with a scoped security assessment. NDA available before any code access.