Key takeaways
- 1DORA has applied across the EU since 17 January 2025: ICT risk management, incident reporting, resilience testing and third-party oversight, with threat-led penetration testing for significant firms.
- 2In the US, listed companies must disclose material cyber incidents on Form 8-K within four business days of deciding they are material.
- 3The regulations overlap heavily. One well-run control set, mapped once, can evidence most of them.
European Union
- DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), in application since 17 January 2025: ICT risk management frameworks owned by the management body; classification and reporting of major ICT incidents; digital operational resilience testing, including threat-led penetration testing (TLPT) at least every three years for significant entities; a register of ICT third-party arrangements; and direct EU oversight of critical ICT third-party providers.
- NIS2 (Directive (EU) 2022/2555), due in national law from October 2024: risk management and incident reporting for essential and important entities, with an early warning within 24 hours, a notification within 72 hours and a final report within a month. Management bodies are personally accountable.
- The Cyber Resilience Act (Regulation (EU) 2024/2847): security requirements for products with digital elements. Reporting of actively exploited vulnerabilities applies from 11 September 2026, and the main obligations from 11 December 2027.
United States
- SEC cybersecurity disclosure rules (effective December 2023): Form 8-K Item 1.05 for material incidents within four business days of the materiality determination, and annual disclosure of cyber risk management, strategy and governance in the 10-K.
- NYDFS 23 NYCRR Part 500 (amended November 2023, fully phased in by November 2025): a CISO, board reporting, annual certification of compliance, multi-factor authentication for all users, and an asset inventory.
- PCI DSS v4.0.1: the future-dated requirements became mandatory on 31 March 2025, including targeted risk analyses, wider MFA and controls on payment-page scripts.
Where they overlap
Read side by side, the regimes ask for the same core: a governed risk framework the board owns, an accurate asset and third-party inventory, tested incident response with fast reporting, resilience testing, strong identity controls and evidence that all of it works. Mapping controls once to a common framework such as NIST CSF 2.0 (which added a Govern function in 2024) avoids building the same thing five times.
Where post-quantum fits
None of these regimes names a post-quantum deadline yet, but several already reach it. DORA's technical standards require cryptographic controls to keep pace with cryptanalysis, NYDFS requires encryption appropriate to risk, and supervisors are reading the G7 roadmap. A cryptographic inventory and a migration plan are fast becoming part of a credible ICT risk framework.
Sources
- EUR-Lex: Digital Operational Resilience Act (DORA) (opens in a new tab)
- EUR-Lex: NIS2 Directive (opens in a new tab)
- EUR-Lex: Cyber Resilience Act (opens in a new tab)
- SEC: Cybersecurity risk management and incident disclosure rules (opens in a new tab)
- NYDFS: Cybersecurity regulation (23 NYCRR 500) (opens in a new tab)
- NIST Cybersecurity Framework 2.0 (opens in a new tab)
General information, not legal or regulatory advice. Standards and deadlines move; check the primary source before relying on a date.