NIS2 and DORA obligations, mapped to evidence.

NIS2 raises the baseline of cybersecurity risk management across essential and important sectors. Entities must adopt technical and organisational measures proportionate to their risk — governance, incident handling, business continuity, supply-chain security, vulnerability handling, and the testing and auditing of those measures — and report significant incidents to the national authority. Management bodies are accountable and can be held liable.

In scope Medium and large organisations in the sectors the directive lists — energy, transport, banking and financial-market infrastructure, health, water, digital infrastructure, ICT service management and public administration as essential entities; postal, waste, chemicals, food, manufacturing, digital providers and research as important entities. In Latvia the duties come from the National Cybersecurity Law, in force since September 2024.

DORA is a directly applicable regulation that sets one operational-resilience rulebook for EU finance. It covers ICT risk management, classification and reporting of major ICT-related incidents, digital operational-resilience testing, management of ICT third-party risk, and information sharing. The most demanding entities must run threat-led penetration testing (TLPT) against live production systems on a multi-year cycle.

In scope Financial entities across the EU — credit institutions, payment and electronic-money institutions, investment firms, insurers and intermediaries, crypto-asset service providers, fund managers and more — together with the critical ICT third-party providers that serve them.