Adopted by the European Union in 2016, the directive on the security of network and information systems, known as the “NIS 1 Directive”, aimed to raise the level of cybersecurity of operators of essential services (OES) and digital service providers (DSP). Banking and financial market infrastructures (sometimes called cyber banks) are among these OES.
1. The new cybersecurity obligations of banking institutions
Under this first framework, banking institutions were required to report their security incidents to ANSSI (the French national cybersecurity agency) and to put in place the security measures needed to significantly reduce the exposure of their most critical systems to cyber risks.
On 10 November 2022, Members of the European Parliament voted for the NIS 2 Directive (Network and Information Security), which aims to raise the level of cybersecurity of essential and important entities, the categories that replace OES and DSP.
A. The context of growing cybercrime
Since its member countries became interconnected, the European market has become more exposed to new cyber threats. The NIS 2 Directive therefore widens its scope and its objectives in order to give European companies and organisations more protection. One of these objectives is to improve cooperation between member countries in the face of this common threat.
Statistics bear witness to the sustained growth of cybercrime worldwide. The figures published by the European Council are striking:
According to estimates, the annual cost of cybercrime to the global economy reached 5,500 billion euros at the end of 2020, double the 2015 figure.
Source: https://www.consilium.europa.eu/fr/infographics/cyber-threats-eu/
B. Why cyber regulations matter for financial institutions
Several reasons explain why these new cyber regulations matter for financial institutions. First of all, they help protect customers’ sensitive data and prevent data breaches. These institutions are now obliged to take effective measures to protect themselves against the different types of cyberattack.
This investment in protecting their IT tools will improve customers’ trust in financial institutions. It will also reduce the prohibitive costs linked to data breaches and cyberattacks.
These measures are all the more important as more and more users access their banking services from a mobile app or from their personal computer. This trend began during the COVID-19 health crisis and has kept growing ever since.
2. The main cyber regulations for financial institutions
A. Overview of existing regulations
The Digital Operational Resilience Act (DORA)
The regulation on digital operational resilience for the financial sector (the DORA regulation) was adopted in its final version by the Council of the European Union in November 2022. It entered into force across Europe on 16 January 2023 and has applied since 17 January 2025.
The main objectives of the DORA regulation concern data protection, as well as the ability to avoid any interruption of service in the event of a cyberattack or malfunction. This ability is known as “cyber resilience”.
The DORA regulation brings in oversight by regulators not only within financial organisations but also at their external providers, which are required to comply with the new cybersecurity standards.
The NIS 1 Directive
The NIS 1 Directive did not apply to DSPs regarded as small businesses (with fewer than 50 employees and an annual turnover or total balance sheet below €10 million). The directive remained fairly general about the cybersecurity measures the organisations concerned had to take.
The number of entities covered by the NIS 1 Directive was fairly limited, since it only applied to operators of essential services and digital service providers. The NIS 2 Directive covers ten times as many organisations, classified as essential entities (EE) and important entities (IE) according to their sector and their size. Sector alone is not enough: in highly critical sectors, large entities are in principle essential and medium-sized entities important; in the other critical sectors, the entities concerned are important. Some entities are essential whatever their size.
Highly critical sectors (Annex I)
- Energy
- Transport
- Banking
- Financial market infrastructures
- Health
- Drinking water
- Wastewater
- Digital infrastructure (internet service providers, data centres…)
- Public administrations
- Space
Other critical sectors (Annex II)
- Waste management
- Postal services
- Chemical industry
- Digital service providers (search engines, marketplaces…)
The penalty regime and the reporting requirements were also less demanding than under the new NIS 2 Directive, which comes closer to the GDPR penalty regime, set as a percentage of the turnover of the organisation concerned (see further down in this article).
B. How regulations have evolved after recent cyberattacks
Since 2022, many departmental councils (French local authorities), health organisations and European financial organisations have been among the victims of cyber criminals. Each time, public services are brought to a standstill for days and have to go back to recording everything on paper while they wait for their IT department to get systems running again.
The NIS 2 Directive will impose even stricter cybersecurity obligations on critical infrastructure such as banks and financial organisations. National authorities are called upon to exercise stricter supervision and enforcement.
The new directive harmonises the penalties applied and the reporting obligations in every Member State of the European Union.
3. The new obligations imposed on financial institutions
A. Stronger data protection measures
In addition to the basic measures, which include reporting obligations, the NIS 2 Directive requires the entities concerned to send an early warning within 24 hours of becoming aware of a significant incident; reporting near misses remains voluntary.
A cybersecurity competence centre and a network of coordination centres have been set up to support financial and banking organisations in their cybersecurity policies. In France, this competence centre role is assigned to the ANSSI Cyber Defence Centre, located on the Quai de Grenelle in Paris.
National supervisory authorities will be able to carry out regular audits in their respective countries, as well as on-site and off-site inspections, and to request access to documents or evidence.
The CyCLONe coordination network (Cyber Crisis Liaison Organisation Network) was created to bring together Member States’ preparation for, and management of, cyber crises.
Member States had to transpose the directive by 17 October 2024 at the latest. France did not meet that deadline: its transposition law has still not been enacted.
B. Setting up early detection mechanisms for cyberattacks
Using AI as a machine learning and predictive analysis tool will make it possible to detect IT attacks more quickly. It will make it possible to automate certain tasks to make online security more effective. This could be, for example, in protection against malware, by analysing files and activity in real time to detect potential threats.
C. Stronger response and recovery capabilities after an attack
The resilience of banking organisations to cyber risk is extremely important, given the financial sums involved and the risk of losing monetary assets. It is therefore essential to draw up a Security Plan that takes into account the consequences of a cyberattack and the means of responding to it.
The cybersecurity tools in use must allow the teams concerned to take immediate action to contain incidents and limit the damage.
Make IT Safe manages your suppliers’ Supplier Security Assurance Plans (SSA): the security commitments they make on your behalf and your exchanges with them are centralised, so that you can react faster when an incident affects one of them.
4. The consequences of non-compliance with cyber regulations
Organisations that fail to comply with European texts such as the NIS 2 Directive or the DORA regulation face heavy fines and financial penalties, not to mention the risks to their reputation with their customers.
Financial and reputational risks for financial institutions
The financial penalty mechanism chosen by the NIS 2 Directive, similar to that of the GDPR, may be based on a fixed amount or on a percentage of the worldwide turnover of the entity concerned, depending on the seriousness of the breach found.
For essential entities (EE): up to €10 million, or 2% of total worldwide turnover.
For important entities (IE): the fine may reach €7 million, or 1.4% of total worldwide turnover.
As cyberattacks are a favourite topic for the media, the consequences of an attack on a financial organisation can seriously damage its reputation with its customers or suppliers, especially if cyber negligence is found.
It is worth remembering that the NIS 2 Directive introduces the notion of management accountability for risk management. This requires the leaders of the organisations concerned to make sure their cybersecurity policy is brought into compliance, without waiting for the French transposition law, whose deadline of 17 October 2024 was missed.
5. Best practices for complying with the new regulations
Make IT Safe supports compliance with these new regulations in three main areas:
A. Regular risk assessment and updating of security measures
Our Make IT Safe platform lets you carry out regular audits of your entire IT structure. This recurring check includes the upload of evidence and supporting documents, so that you can prove to the competent authorities, if necessary, that you have indeed taken all the corrective measures needed to comply with the NIS 2 Directive.
B. Staff training and awareness
Cybersecurity also depends on building the skills of staff exposed to the risk of attack, particularly “social engineering” attacks, which rely precisely on a lack of awareness within financial organisations.
Make IT Safe regularly publishes webinars that your employees can attend to keep themselves informed. We also offer tailor-made training adapted to the structure of your organisation and to your employees’ skills.
C. Working with regulators and external partners
Information sharing is part of any good security policy. In the event of a confirmed incident or an attack, you not only have to react to safeguard your organisation’s interests, you also have to notify the regulatory bodies concerned. In France, this means contacting ANSSI, which offers different forms to report a vulnerability or to report an incident.
If you are a CISO or a DPO, or hold any other position that requires keeping watch on cybersecurity, we recommend that you keep regularly informed of the alerts issued by the French government centre for monitoring, alerting and responding to computer attacks (CERT).
Our Make IT Safe platform also lets you carry out a third-party analysis so that you can assess the cyber risk linked to your suppliers or external providers.
6. Conclusion
As we have just shown in this article, the cybersecurity of financial institutions is a matter of prime importance at European level, as these new regulatory provisions confirm.
Admittedly, it is sometimes difficult to take on new constraints. It calls for a significant investment in both human and material resources. However, when you remember the astronomical cost of the damage caused by these cyberattacks, it is easy to see why this investment is essential to secure the future of financial organisations and of the other players in the European economy.
For its part, Make IT Safe has anticipated the changes needed in its software platform to deal with these new threats. Our platform gives you a view that is both simple and complete of every action to be taken for your organisation to comply fully with these new regulations.
To see how the requirements of NIS 2 and DORA translate into action plans in the platform, request a demonstration.
