The New Cloud Regulations (DORA, NIS2): What SMEs Need to Know to Stay Compliant

Introduction

The European regulatory landscape is undergoing a major shift, and companies using cloud services are now on the front line. Long perceived as texts primarily aimed at large financial groups or critical infrastructure, the new regulations DORA (Digital Operational Resilience Act) and NIS2 (Network and Information Security Directive 2) have a much broader scope. They now impose binding obligations and potentially heavy sanctions on a multitude of medium-sized enterprises and even some SMEs. For SME leaders, this is no longer just a matter of regulatory monitoring, but a strategic imperative for survival and credibility. This article deciphers the essentials of these legal frameworks and proposes a pragmatic roadmap for successful compliance.

The European regulatory landscape is undergoing a major shift, and companies using cloud services are now on the front line. 

Why Are SMEs Affected? The Paradigm Shift

The misconception that "these laws only concern big players" is now dangerously false. DORA and NIS2 represent a fundamental change by targeting not just specific sectors, but the entire interconnected digital ecosystem. An SME can be directly subject to these rules if it operates in a covered sector (such as logistics, energy, transport, digital health, digital manufacturing), or indirectly if it is a provider of essential or important digital services to a regulated entity. In other words, if your SME provides cloud services, data management, or a SaaS platform to a bank or energy operator, you become a critical link in their chain and must comply.

Decoder 1: The DORA Regulation – Operational Resilience for the Financial Sector (and Beyond)

Adopted in December 2022, DORA aims to ensure the digital operational resilience of the entire European financial sector against cyber threats. Its particularity? Its scope extends extraterritorially to all critical ICT service providers (so-called "ICT third-party providers") of these financial entities, regardless of their size or location.

1. The obligation for third-party risk management (TPRM): Your relationship with your financial clients is changing

DORA requires financial entities to continuously map, assess, and monitor the risks posed by their technology providers. Concretely, if your SME provides management software, a payment platform, hosting, or cybersecurity services to a bank or fintech, expect detailed compliance questionnaires, contractual audits, and strengthened contractual requirements regarding security, incident reporting, and testing.

2. Mandatory resilience testing: Proving your systems are robust

Financial entities must conduct advanced resilience tests (penetration testing, crisis scenarios). Your cloud services will necessarily be included in the scope of these tests. You will need to demonstrate your ability to maintain a defined service level (via strict SLAs) even in the event of an attack or failure, and to restore your services within contractual timeframes.

3. Reporting of major incidents: Transparency required within 24 hours

DORA imposes extremely rapid reporting of major security incidents to supervisory authorities. If an incident at your company (outage, cyberattack) impacts your financial client, you must inform them immediately so they can comply with their own reporting obligations. Your ability to detect, analyze, and communicate about incidents becomes a key contractual criterion.

Decoder 2: The NIS2 Directive – Radically Expanding the Cybersecurity Perimeter

NIS2, enacted in 2023 with a transposition deadline into national laws by October 2024, significantly expands the first NIS directive. It aims to harmonize and strengthen cybersecurity requirements across the EU.

1. The expansion of covered sectors and company sizes: Check your eligibility

NIS2 now covers 18 sectors (up from 7 previously), including energy, transport, health, digital infrastructure (cloud hosting providers, DNS providers), but also manufacturing (pharmaceutical, medical, critical equipment), postal and courier logistics, waste management, and R&D. The size criteria are also revised: all medium and large enterprises in these sectors are covered. A "medium-sized enterprise" is defined as having more than 50 employees and/or a turnover/total balance sheet > €10 million. A significant portion of the economic fabric is therefore affected.

2. "Appropriate and proportionate" security measures: A demanding baseline

NIS2 mandates the implementation of technical and organizational measures, such as risk management, supply chain security, vulnerability management, cryptography, business continuity, employee training, and, of course, security policies for the use of cloud services. The notion of "proportionality" is key for SMEs, but it does not mean inaction.

3. Management accountability and strengthened sanctions: A governance issue

Management (CEO, board of directors) is now personally responsible for approving the cybersecurity policy and overseeing its implementation. Sanctions for non-compliance are substantial, potentially up to €10 million or 2% of global annual turnover, and in severe cases, a temporary ban for managers from holding executive positions.

Roadmap for SMEs: 6 Steps Towards Compliance

Faced with this complexity, a methodical and progressive approach is essential.

1. Step 0: Applicability Assessment

Determine if your company falls directly under NIS2 based on its sector/size. Analyze your client contracts to see if you provide services to entities in the financial sector (DORA) or to critical/important entities covered by NIS2.

2. Mapping and Risk Assessment

Inventory your critical IT assets, data flows, and third-party dependencies (notably your cloud providers). Conduct a targeted risk analysis focused on business continuity and data security. This exercise is the foundation of your entire approach.

3. Strengthening the Governance Framework and Policies

Formally involve your management. Document your information security policies, incident management policies, and operational resilience policies. Establish a formal process for approving and reviewing security for IT and cloud procurement.

4. Implementation of Priority Technical Measures

Prioritize high-impact actions: multi-factor authentication (MFA), encryption of sensitive data, tested offline backups, network segmentation, security log monitoring. Assess and strengthen security clauses in your contracts with cloud providers (SLAs, audit rights, data location).

5. Preparation for Incident Management and Reporting

Develop and test a cyber incident response plan. Define internal procedures for detection, escalation, and communication, including to your regulated clients if necessary. These processes must be documented.

6. Documentation and Audit Evidence

Your entire approach must be traceable. Document your risk analyses, decisions, tests, and incidents. This documentation will be your first line of defense in case of an inspection or a request from a regulated client.

Conclusion: Compliance, the New Competitive Lever

For SMEs, DORA and NIS2 should not be perceived solely as a regulatory burden, but as a strategic opportunity. Rigorous compliance allows you to:

• Strengthen trust with clients and partners, becoming a differentiating commercial advantage.

• Structure and improve IT security, reducing operational risk and the costs associated with incidents.

• Position yourself as a supplier of choice for large corporations and regulated sectors, opening new markets.

The compliance deadline is limited (2025 for DORA, and national transposition dates for NIS2). Inaction exposes you to major financial, contractual, and reputational risks. By starting now with an honest assessment of your position, any SME can transform this obligation into a profitable investment for its resilience and future growth. Compliance is no longer an option; it is the new standard of operational excellence in the digital economy.