Operational resilience & cyber (DORA / NIS2 / SEC)

Tracks the regulatory tightening of digital operational resilience: DORA and NIS2 entering enforcement in the EU, the SEC's incident-disclosure rules in the U.S., CIRCIA reporting deadlines and the personal liability of management bodies. Each entry documents the rule, deadline, extraterritorial scope and penalty.

Snapshot · June 8, 2026

regulatory milestones

↑ 4 operational-resilience milestones documented; 2026 is the first real DORA and NIS2 enforcement cycle, with personal liability for management bodies, extraterritorial scope and reporting deadlines of 72 hours for incidents and 24 hours for ransomware payments

Evolution

Data analysis

Statistical readings derived from the attributes of each recorded case. All figures come from the documented events; amounts are computed only over cases with a sum expressed in the indicated currency, without converting between currencies.

Regulatory framework

DORA, NIS2, SEC cyber disclosure or CIRCIA: which regime generates the obligation.

Jurisdiction

EU, U.S., UK or others: where it applies, with frequent extraterritorial reach.

Obligation type

Incident reporting, third-party risk management, management liability or public disclosure.

Reading the data

In 2026 cybersecurity stops being something a board can delegate to its CISO: DORA and NIS2 enter their first enforcement cycle with personal liability for management bodies, extraterritorial scope and reporting deadlines measured in hours.

Alexandra A. Medina · Technology expert · Ciudad de México
June 8, 2026 · 5 min read

For years, the two European cyber-resilience regimes —the Digital Operational Resilience Act (DORA) and the NIS2 Directive— were experienced by compliance teams as deadlines on a distant horizon. In 2026 that changes. DORA, applicable since January 2025 for financial entities, enters its first genuine supervisory cycle, and regulators have signaled they will act on incident-reporting failures and persistent deficiencies in the Register of Information.

Liability rises to the board

NIS2 makes management bodies responsible for approving and overseeing risk-management measures, requires them to train and provides that they can be held liable for the entity's failures. DORA likewise vests ultimate responsibility for the ICT risk framework in the management body. Cybersecurity is no longer delegable as an operational matter: it is a governance obligation with personal consequences.

Why it affects U.S. and LATAM firms

The reach of these rules is extraterritorial: non-European entities fall within their radius if they have a significant presence or provide services to the EU market. For Latin America, where many firms operate as digital-service providers to European clients, this means the European resilience framework becomes a de facto requirement. In the U.S., the SEC requires listed companies to establish cyber-risk governance for annual disclosure, and CIRCIA contemplates reporting significant incidents within 72 hours and ransomware payments within 24 hours.

NIS2 expands the scope to more than 100,000 entities across 18 sectors, a huge jump from the original directive. The transposition deadline expired in October 2024, but only a limited number of member states had incorporated it on time, creating an uneven map that multinational companies must track country by country.

Sources: ComplianceHub; Moody's; AIGovHub; VinciWorks. This tracker distinguishes between effective date, transposition date and first effective enforcement case, and does not anticipate penalties not yet imposed.

Documented events (4)

February 10, 2026 US confirmed

US · The SEC requires cyber-risk governance for listed companies' annual disclosure

The SEC's cybersecurity rules require listed companies to establish cyber-risk management and governance processes for annual 10-K disclosure, including board oversight, management responsibility and processes to assess and manage material risks. After the first year of application, the pattern shows most incidents do not end up with confirmed material impact, though companies disclose early out of caution. The SEC unit also increased scrutiny of AI claims ('AI washing').

ComplianceHub — SEC cybersecurity rules: a year of enforcement and investor scrutiny ↗

March 5, 2026 US confirmed

US · CIRCIA: report incidents within 72 hours and ransomware payments within 24 hours

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA, 2022) will require reporting significant cyber incidents within 72 hours and ransomware payments within 24 hours. While the final rule is being finalized (expected 2025-2026), organizations in critical-infrastructure sectors must prepare to register their reporting systems with CISA. The framework adds to a global landscape —alongside NIS2, DORA and SEC rules— demanding faster, more transparent incident disclosure with distinct deadlines and formats.

AIGovHub — Cybersecurity incident response: NIS2, DORA, CISA & SEC compliance ↗

January 20, 2026 EU confirmed

EU · NIS2 reaches more than 100,000 entities across 18 sectors, with management liability

The NIS2 Directive expands its scope to more than 100,000 large and medium-sized entities across 18 sectors —energy, transport, banking, financial market infrastructures, health, water, digital infrastructure, public administration and space—, a significant increase over the original directive. It makes management bodies responsible for approving and overseeing risk-management measures, with maximum fines higher than DORA's. The transposition deadline expired on October 17, 2024, but only a limited number of countries had incorporated it on time.

Moody's — Understanding the NIS2 regulation ↗

January 15, 2026 BE confirmed

EU · DORA enters its first real enforcement cycle for financial entities

The Digital Operational Resilience Act (DORA), applicable since January 2025 for EU financial entities, enters in 2026 its first genuine supervisory cycle. Regulators have signaled they will act on incident-reporting failures and persistent deficiencies in the Register of Information. Unlike NIS2, DORA is a directly applicable regulation across all member states, with no national transposition needed, and its technical standards were finalized, enabling effective supervision.

ComplianceHub — DORA enforcement arrives and NIS2 hits its October deadline ↗

Methodology

Type: event-log
Construction: Multi-source verified
Cadence: event-driven

We document verifiable milestones of the digital operational-resilience framework: DORA and NIS2 application and enforcement dates, SEC disclosure rules, CIRCIA deadlines and cases illustrating management-body liability. Each event is classified by rule, jurisdiction, deadline and obligation type. We distinguish between effective date, transposition date and first effective enforcement case.