Skip to content
    Home / Authority

    Government

    While agencies provide the technical “how-to,” national governments provide the legal “must-do” by transforming voluntary standards into binding statutory requirements. Their role is to codify cybersecurity as a matter of national security and public safety through comprehensive laws—such as the EU’s NIS2 Directive, the Cyber Resilience Act (CRA), or the UK’s Cyber Security and Resilience Bill. By 2026, governments have shifted toward active enforcement, moving beyond simple guidance to mandate specific outcomes: rigorous incident reporting within 24–72 hours, supply chain transparency, and personal liability for “management bodies” who fail to oversee risk. Through these laws, governments ensure that cybersecurity is no longer a discretionary IT expense but a foundational legal obligation for any entity operating within critical infrastructure or the digital single market.

    EU Commission Implementing Regulation 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat

    Commission Implementing Regulation (EU) 2025/302 of 23 October 2024 establishes implementing technical standards for the application of Regulation (EU) 2022/2554 concerning digital operational resilience for the financial sector. Specifically, it… Read More »EU Commission Implementing Regulation 2025/302 of 23 October 2024 laying down implementing technical standards for the application of Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to the standard forms, templates, and procedures for financial entities to report a major ICT-related incident and to notify a significant cyber threat

    EU Commission Delegated Regulation 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

    Commission Delegated Regulation (EU) 2025/301 of 23 October 2024 supplements Regulation (EU) 2022/2554 by establishing regulatory technical standards that specify the content and time limits for reporting major ICT-related incidents… Read More »EU Commission Delegated Regulation 2025/301 of 23 October 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the content and time limits for the initial notification of, and intermediate and final report on, major ICT-related incidents, and the content of the voluntary notification for significant cyber threats

    EU Commission Delegated Regulation 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers

    Commission Delegated Regulation (EU) 2024/1773 of 13 March 2024 supplements Regulation (EU) 2022/2554 (DORA) by establishing regulatory technical standards that specify the detailed content required in policies governing contractual arrangements… Read More »EU Commission Delegated Regulation 2024/1773 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the detailed content of the policy regarding contractual arrangements on the use of ICT services supporting critical or important functions provided by ICT third-party service providers

    EU Commission Delegated Regulation 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework

    EU Commission Delegated Regulation 2024/1774 of 13 March 2024 supplements Regulation (EU) 2022/2554 (DORA) by specifying regulatory technical standards (RTS) that detail ICT risk management tools, methods, processes, and policies… Read More »EU Commission Delegated Regulation 2024/1774 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying ICT risk management tools, methods, processes, and policies and the simplified ICT risk management framework

    EU Commission Delegated Regulation 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents

    Commission Delegated Regulation (EU) 2024/1772 of 13 March 2024 supplements Regulation (EU) 2022/2554 by establishing regulatory technical standards (RTS) that specify the criteria for classifying ICT-related incidents and cyber threats… Read More »EU Commission Delegated Regulation 2024/1772 of 13 March 2024 supplementing Regulation (EU) 2022/2554 of the European Parliament and of the Council with regard to regulatory technical standards specifying the criteria for the classification of ICT-related incidents and cyber threats, setting out materiality thresholds and specifying the details of reports of major incidents