🔐 Regulation Without the Panic: What NIS2, DORA, CRA & the UK Resilience Bill Mean for You

Cyber Rules Are Changing Across Europe—Here’s What You Need to Know (and What You Don’t)

The Cyber Compass

Jul 31, 2025

36 countries.
4 overlapping laws.
Dozens of new obligations.

And one rising question from business owners across the EU and UK:

“Do I need to worry about this?”

The answer: maybe—but not in the way you’ve been led to believe.

📜 The New Cyber Rules, in Plain English

Here are the four major frameworks reshaping security expectations across Europe:

1. NIS2 Directive (EU)

The updated Network and Information Security Directive expands EU-wide cyber obligations.

You may fall under NIS2 if you:

✅ Operate in sectors like energy, transport, finance, health, or digital infrastructure
✅ Run a medium-sized or large company (50+ staff or €10M+ turnover)
✅ Provide critical digital services like DNS, cloud, or trust services

Key obligations:

Risk management plans
Incident response
Board-level accountability
24-hour incident notification

💡 Most micro and small businesses are excluded—unless they deliver essential services (source).

2. DORA (EU)

The Digital Operational Resilience Act applies to:

✅ Banks, insurance firms, fintechs, crypto service providers
✅ Their ICT third-party providers—such as cloud, SaaS, hosting or security vendors

Focus:

Operational continuity
ICT risk management
Testing, reporting, and vendor oversight

💡 If you’re not in finance or directly contracted by financial clients, this law likely doesn’t apply to you.

3. Cyber Resilience Act (CRA)

The CRA targets hardware and software makers of connected devices.

Applies to you if you:

✅ Develop, import, or sell smart devices, industrial control systems, IoT software
✅ Operate in the EU market

Core duties:

“Secure by design” development
Mandatory patching support
Vulnerability management

💡 If you don’t make or import connected products, this law doesn’t affect you directly.

4. UK Cyber Security & Resilience Bill

Still in draft (as of mid‑2025), this bill will:

✅ Expand regulation of digital service providers (e.g. MSPs, data centres)
✅ Emphasise downtime accountability, supply chain risk, and reporting obligations

Why it matters:

It's modelled on NIS2
It may affect small UK-based SaaS or IT providers
It includes 24–72 hr incident reporting and client notification requirements

💡 Final scope is still being defined, but small vendors supporting regulated industries may be brought in.

🤯 Why This Feels Overwhelming—Even If You’re Not Directly Regulated

If you’re a freelancer, coach, consultant, or small business owner, you may not be named in these laws.

But here’s how they still impact you:

Clients will ask for documentation
Larger vendors will pass obligations down to you
Cyber insurance and funding bodies will tighten requirements

So even if you’re not “in scope,” you’ll feel the ripple effects.

🧭 What Human-Centric Compliance Actually Looks Like

Forget the fearmongering. Forget the spreadsheets.

Here’s how to build resilience without burnout:

🔐 1. Security by Default

Set up systems so that secure is the default.

Use MFA on all accounts
Require strong passwords
Enable auto-updates
Disable unused tools or accounts

These basics align with nearly all frameworks above—and protect you every day.

📊 2. Keep a Simple Risk Register

It doesn’t have to be fancy.

Track:

The tools you use
Their potential risks (e.g. “Canva – accidental sharing”)
What you’ve done (e.g. “limited sharing to team only”)

This shows awareness—and that counts.

📁 3. Map Your Data Flows

Know:

What personal data you collect
Where it’s stored
Who has access
How long you keep it

This makes GDPR, client queries, and platform audits easier.

🚨 4. Create a “What If” Plan

Even a one-pager will save you time and panic.

Include:

Who to contact (IT, clients, legal)
Where backups are stored
How you’ll communicate with clients if systems go down

This meets business continuity expectations in NIS2, DORA and the UK Bill.

🧩 The Good News: You Can Start Small—And Still Be Compliant

Compliance doesn’t require a lawyer.

It requires clear thinking and documented intent.

And when regulations evolve again (they will), you won’t be scrambling.

📌 TL;DR — What to Do Without Burning Out

✅ Know which laws apply (CRA if you make tech, NIS2 if you host or run infra, DORA if in finance)
✅ Expect ripple effects, even if you’re exempt
✅ Focus on basics: MFA, backups, data visibility
✅ Write down your crisis plan and review tools quarterly
✅ Show accountability, not perfection

🧠 Final Thought: Compliance Isn’t Just Policy—It’s Protection

Cyber laws aren’t just paperwork—they’re about protecting people.

When you:

Harden logins
Encrypt client data
Document decisions

You’re not just following rules.
You’re showing your business is safe, reliable, and worthy of trust.

And that’s the real goal of regulation.

Heather Roache
Founder, The Cyber Compass
Navigate the Digital World with Confidence