Cybersecurity Law and Compliance

Cybersecurity law and compliance is the framework of statutes, regulations, and standards that require organisations to protect information systems and to disclose when they fail. It has expanded rapidly as cyber incidents have grown in frequency and impact, and as regulators have moved from guidance to obligation. The late 2020s landscape — NIS2 in the EU, SEC cyber disclosure in the US, DORA for finance, sectoral rules worldwide — makes cybersecurity a legal duty, not just a technical one.

The shift is from 'should protect' to 'must protect and must disclose'. Organisations now face legal obligations to implement risk-based security measures, to report incidents on defined timelines, and to disclose material cyber events to investors and markets. Failure is no longer just a breach; it is a compliance violation with its own penalties. The duty of care is being defined by law and by standards (ISO 27001, NIST CSF 2.0) that the law references.

This page covers the NIS2 directive, the SEC cyber disclosure rule, DORA for finance, breach notification obligations, the standards defining the duty of care, and what organisations must do to comply.

The Network and Information Security Directive 2 (NIS2), in force from 2024, is the EU's broadened and strengthened cybersecurity law. It expands the scope of NIS1 (which covered a narrow set of critical sectors) to a wide range of 'essential' and 'important' entities across energy, transport, banking, financial market infrastructure, health, drinking water, digital infrastructure, public administration, and space. It raises the obligations (risk management, incident reporting, governance) and the penalties (up to €10M or 2% of global turnover for essential entities).

NIS2's obligations include implementing risk-management measures (incident handling, business continuity, supply-chain security, secure system acquisition, vulnerability handling, encryption), reporting significant incidents on a fast timeline (early warning within 24 hours, full report within 72 hours, final report within one month), and governance duties on management (training, oversight, and personal liability for failures). The governance duties are notable: directors can be held personally liable for cybersecurity failures — a significant escalation.

The supply-chain security obligation is increasingly important. NIS2 entities must address cybersecurity in their supply chains, including vendor due diligence and contractual security requirements. This extends the obligation up the supply chain — NIS2 entities demand security from their vendors, who must in turn demand it from theirs. The result is a cascade of security obligations that raises the baseline across the ecosystem, not just at the regulated entities.

The US Securities and Exchange Commission's cyber disclosure rule (effective late 2023) requires public companies to disclose material cybersecurity incidents on a Form 8-K within four business days of determining materiality. The rule closes a gap: previously, cyber incidents were disclosed inconsistently, if at all. Now, material incidents are disclosed on a defined timeline, giving investors timely information on a significant risk.

The materiality determination is the rule's crux. A cyber incident is material if a reasonable investor would consider it important — which includes both the incident's impact and the potential impact. The determination requires legal and management judgment, often under uncertainty (the full impact of an incident may not be known for weeks). The four-day clock starts when materiality is determined, not when the incident started — but determining materiality promptly is itself an obligation, and delay is scrutinised.

The rule also requires annual disclosure of cybersecurity risk management, strategy, and governance — describing the processes for assessing and managing cyber risk, the role of management, and board oversight. This shifts cybersecurity from an incident-by-incident disclosure to a continuous governance disclosure, pushing companies to formalise and describe their cyber programmes. The governance disclosure is where the legal duty and the security programme meet.

The Digital Operational Resilience Act (DORA), applicable from January 2025, is the EU's cybersecurity law for the financial sector. It applies to banks, insurers, investment firms, and their critical ICT vendors. DORA's premise is that operational resilience — the ability to withstand, respond to, and recover from ICT disruptions — is a financial-stability concern, and it requires regulated firms to manage it as such.

DORA's obligations include ICT risk management, incident reporting (with a classified severity framework), digital operational resilience testing (including threat-led penetration testing for significant firms), third-party risk management (with specific rules for critical ICT providers, including oversight by regulators), and information sharing (threat intelligence). The third-party rules are notable: critical ICT providers to finance face direct regulatory oversight, closing the gap where critical vendors were outside financial regulators' reach.

DORA's significance is the convergence of cybersecurity and operational resilience into one regime. A financial firm's cyber incidents are operational resilience events, and its resilience is a regulatory concern, not just a firm-level matter. The firms that build integrated operational-resilience programmes (not separate cyber, BC, and vendor programmes) comply efficiently; those with siloed programmes must integrate to comply. DORA is a model other sectors may follow.

Breach notification — telling regulators and affected individuals about a personal-data breach — is a near-universal obligation, but the details vary by regime. GDPR requires 72-hour notification to the supervisory authority and notification to individuals for high-risk breaches. US state laws vary (all 50 states have them), with different triggers and timelines. Sectoral laws (HIPAA in healthcare, GLBA in finance) have their own rules. The patchwork is the compliance challenge.

The operational implication is incident-response processes that can assess a breach against multiple regimes' thresholds and timelines simultaneously. A single breach may trigger GDPR notification (72 hours), SEC disclosure (4 days, if material), state notifications (varies), and sectoral notifications — each with its own content requirements and recipients. The process must identify which apply, prepare each notification, and meet each timeline, often while the incident is still being investigated.

The trend is toward faster and broader notification. Regulators are tightening timelines (NIS2's 24-hour early warning is among the fastest) and expanding what counts as a reportable incident. The organisations that treat breach notification as a prepared capability — rehearsed, with templates and decision trees — meet their obligations; those that improvise under incident pressure miss deadlines and disclosures, compounding the original incident with compliance failures.

Cybersecurity law rarely specifies technical measures in detail; instead, it requires 'appropriate' or 'risk-based' measures and points to standards as the reference for what that means. ISO 27001 (the international information security management standard) and the NIST Cybersecurity Framework (CSF) are the dominant references. Compliance with these standards is strong evidence of meeting the legal duty of care.

The NIST CSF was updated to version 2.0 in 2024, expanding the original five functions (Identify, Protect, Detect, Respond, Recover) with a sixth (Govern) and adding supply-chain risk management throughout. The Govern function reflects the regulatory shift toward governance accountability — the same shift visible in NIS2's management-liability provisions and the SEC's governance disclosure. The framework is increasingly the global reference for organising a cyber programme.

ISO 27001 certification remains the most widely recognised evidence of an information security management system, required or expected in many B2B and regulated contexts. The certification, with its risk-based approach and continual improvement, demonstrates a systematic programme — not just point controls. For the legal duty of care, the combination of a framework (NIST CSF to organise) and a management system (ISO 27001 to operate and certify) is the strongest position.

Cybersecurity-law compliance requires an organisation to know its regimes (which apply — by sector, geography, and data type), to implement a risk-based security programme against a recognised framework, to prepare incident response that can meet multiple notification timelines, to manage vendor risk contractually, and to govern cybersecurity at the board level. Each is an operational capability, not a one-off project.

The governance dimension is the new emphasis. NIS2's management liability, the SEC's governance disclosure, and DORA's board-oversight requirements all push cybersecurity to the board level. The board that treats cyber as an IT issue is failing its duty; the board that treats it as an enterprise risk, with oversight and reporting, is meeting it. The legal duty is increasingly a governance duty, and the personal-liability provisions make it consequential for directors.

The compliance programme must be continuous. Cyber threats evolve, the regulatory landscape evolves, and the organisation's systems evolve — a programme that is not continuously updated drifts out of compliance. The organisations that build cybersecurity and compliance as continuous programmes — assessed, improved, reported — stay compliant; those that treat them as periodic projects fall behind between cycles and face compliance gaps that incidents then expose.