DORA, the CRA, and the new Cybersecurity Act: What to do when several regulations apply to you at once

About the webinar

Cybersecurity regulations are multiplying and, for many organizations, starting to overlap. A bank, an insurer, or a payment service provider may fall under both DORA and the new Cybersecurity Act. A critical infrastructure operator, in turn, deals with the Critical Infrastructure Act and the Cybersecurity Act at the same time. And each regulation has its own authority, its own obligations, and its own deadlines.

In practice, this means confusion about where to register, which measures actually apply, whom to report incidents to and within what time limits, and who can come to you for an audit. It's then easy for an organization to do something twice unnecessarily, or conversely to forget an obligation because it expects it from a different authority.

In the webinar, we'll walk through how to untangle such an overlap – who typically falls under it, what changes with registrations, measures and incident reporting, and which authorities can carry out an inspection at your organization if you fall under several regulations at once.

Agenda

• Who typically ends up in the overlap: which companies and organizations fall under several regulations at once and how to tell. 
• Registration with public authorities: where you need to register – the NÚKIB portal, the critical infrastructure portal, SDAT. 
• Security measures and incident reporting: which measures you must apply when requirements overlap, and whom to report incidents to and within what time limits.  
• Who can inspect you: which public authorities can carry out an audit at your organization if you fall under several regulations, and what that means in practice.  
• Other specifics of the overlap: what to watch out for when regulations coincide and how to organize your obligations so you don't do them twice.