Knowledge
Guides on NIS2, ISO 27001, DORA, TISAX and cyber tabletop exercises. Written for IT leads, ISMS and compliance officers and management in mid-sized organisations across the EU.
Articles on the national transposition of NIS2 in Germany and Austria are available on our German knowledge pages.
NIS2
ISO 27001 and TISAX
DORA
DORA explained: the overview
Regulation, scope, the five pillars and the date of application.
Who does DORA apply to?
Financial entities, ICT third-party providers and exemptions.
Resilience testing and TLPT
The testing programme and threat-led penetration testing explained.
DORA deadlines
Entry into force, date of application and ongoing obligations.
BCM and incident response
Business continuity management
The BCM lifecycle, BIA, RTO/RPO and ISO 22301.
BCM testing
Testing continuity plans with a tabletop exercise and documenting the result for the audit.
Business impact analysis
Process, metrics (MTPD, RTO, RPO) and structure of the BIA.
RTO and RPO
Definition, difference and how both metrics are derived.
ISO 22301
Requirements, certification and the link to ISO 27001.
Incident response plan
Structure, NIST phases, reporting obligations and how to test the plan.
Methods and terms
Cyber tabletop exercise
Definition, process, frequency, participants and examples of the discussion-based exercise.
Tabletop scenarios
8 scenarios with injects, a facilitation guide and an observation sheet.
MSEL
Master scenario events list: the script of every exercise.
After-action review
Evaluating exercises and turning findings into a tracked action plan.