Why should I prepare my team for NIS2 / DORA / the Cyber Resilience Act?

Preparation reduces uncertainty, improves the consistency of decisions and helps the organisation demonstrate evidence to auditors, authorities, clients or partners. It also makes it possible to allocate responsibilities before an incident occurs or an urgent request for information is received.

It depends on the objective. Training is a starting point for developing capabilities and creating a common language. When the organisation needs to implement, review or verify controls, training may need to be complemented by advisory services or internal audit.

Which course should I choose?

Choose according to the applicable framework, your role and your level of responsibility. NIS 2 Compliance Lead Manager is intended for professionals who need to lead a NIS 2 compliance framework, from scope and governance to measures, reporting, supervision and evidence. DORA Compliance Lead Manager is intended for professionals who need to operationalise governance, ICT risk, incidents, resilience testing, third parties and evidence in the DORA context. Cyber Resilience Act Foundation is intended for professionals who need to understand the scope and security requirements applicable to products with digital elements throughout their lifecycle. For awareness, foundation-level knowledge or executive governance, consider the other pathways in Digital Compliance and Operational Resilience.

Does ISO 27001 guarantee automatic compliance with DORA?

No. ISO/IEC 27001 does not replace DORA and does not remove the need to analyse the applicable legal requirements. However, a well implemented Information Security Management System can support ICT risk management, documentation, evidence of controls, incident response and governance in regulated environments.

Which organisations should consider ISO 27001 training in the context of DORA?

Training should be considered by financial entities within the scope of DORA, their ICT service providers and organisations that provide cloud services, software, outsourcing, technology support, consultancy, auditing, data management or other critical services. It is also relevant for organisations that want to improve their Information Security posture and respond to enterprise client requirements.

Is ISO 27001 only for IT teams?

No. Although it includes technical controls, ISO 27001 is a management standard. It involves leadership, compliance, quality, HR, procurement, legal, operations, physical security, communications and all areas that handle relevant information. Security depends on technology, but also on processes, responsibilities and human behaviour.

What is the difference between implementing and certifying ISO 27001?

Implementing means creating and operating an Information Security Management System aligned with the requirements of the standard. Certifying means submitting that system to an audit by an independent certification body. An organisation can start by aligning with the standard and later move towards certification, depending on its objectives, risks and market requirements.

DORA Archives

Practical Guide NIS 2_DORA_Cyber Resilience Act

NIS2 / DORA / Cyber Resilience Act: what changes and how to prepare your organisation

Scope, governance, risk, incidents, third parties, digital products and evidence: a practical structure for preparing your organisation without confusing distinct regulatory frameworks.

⏱️ Estimated reading time: 7–8 minutes

NIS2, DORA and the Cyber Resilience Act are transforming how organisations manage risk, incidents, third parties, products with digital elements and evidence. Although they share some concerns, they apply to different contexts and require different responses.

In Portugal, Decree-Law No. 125/2025 established the new Cybersecurity Legal Framework, transposing NIS2, and entered into force on 3 April 2026. Regulation No. 756/2026, in force since 23 June, set out matters such as the operation of the electronic platform, the National Cybersecurity Reference Framework, the risk matrix, minimum measures and verification criteria.

DORA has applied directly since 17 January 2025. Under the Cyber Resilience Act, reporting obligations start to apply on 11 September 2026, while the Regulation applies generally from 11 December 2027.

ISO 27001 and DORA: how to align information security, ICT risk and operational resilience

ISO/IEC 27001 does not replace DORA, but it can provide a solid foundation for organising Information Security, ICT risk management, continuity, documented evidence and supplier oversight.

⏱️ Estimated reading time: 5 minutes

Information Security is no longer only a technical responsibility. Today, it is also a priority for management, compliance, business continuity and digital trust.

With DORA, financial entities and many of their service providers face more demanding requirements for ICT risk, incidents, digital operational resilience testing and third-party management. In this context, ISO/IEC 27001 becomes particularly relevant because it offers a recognised framework for organising policies, responsibilities, controls, evidence and continual improvement.

For organisations and professionals, understanding the connection between ISO 27001 and DORA can be a strategic advantage.

Select your language

Articles tagged with: DORA

NIS2 / DORA / Cyber Resilience Act: what changes and how to prepare your organisation

ISO 27001 and DORA: how to align information security, ICT risk and operational resilience