Home / Solutions / NIS2 and DORA
Solution · NIS2, the Cyber Security Act and DORA
Phishing-resistant MFA that withstands a NIS2 or DORA audit.
NIS2, the Cybersecurity Act, and DORA make strong authentication a board-level priority. Ciptor converts this into hardware-bound authentication, mapped requirement by requirement, with verifiable evidence for supervisory authorities.
Does the Cybersecurity Act require multi-factor authentication?
Yes, where required. The Cybersecurity Act (2025:1506) has applied since 15 January 2026 and implements NIS2 in Sweden. Under Chapter 2, Section 3, covered entities must implement authentication solutions as part of their security measures. This aligns with Article 21.2(j) of the NIS2 Directive. Management must also receive training on these security measures pursuant to Chapter 2, Section 4.
Does DORA require strong authentication?
Yes. DORA applies to financial entities in the EU as of 17 January 2025. Article 9 requires policies and protocols for strong authentication mechanisms as part of ICT risk management.
Requirements map
What the regulations require, what Ciptor delivers, and what you can demonstrate.
Requirements
What Ciptor delivers
Evidence provided
NIS2 Art. 21.2(j) · CSL Ch. 2, Section 3, Item 10
Multi-factor authentication
FIDO2 security keys and hardware passkeys for all users, administrators, and consultants
Coverage report: who uses which authentication method
NIS2 Art. 21.2(i) · CSL Ch. 2, Section 3, Item 9
Access control and asset management
Security keys are issued following identity verification, with workflows for onboarding, replacements, and offboarding.
Key register and revocation log
NIS2 Art. 21(2)(d) · CSL Ch. 2 Section 3 Item 4
Supply chain security
Corporate-issued security keys for third parties with privileged access
Third-party access register
NIS2 Art. 21.2(f) · CSL Ch. 2, Section 3, Item 6
Assessment of control effectiveness
Red Team exercise before and after deployment
Penetration test report for the board
NIS2 Art. 20 · CSL Ch. 2 Section 4
Management responsibility and training
Board briefing and risk analysis in plain English
Approved control description
DORA Art. 9
Strong authentication
Hardware-bound authentication with risk-based step-up
Documentation of policy and protocol
Why phishing-resistant
"MFA" on paper is not MFA that an attacker respects.
SMS, authenticator codes, and push approvals meet compliance criteria, but are routinely bypassed by phishing kits. Regulators and insurers increasingly ask which type of MFA you deploy. Hardware-bound authentication provides a clear answer.
SMS / authenticator app code
Vulnerable to phishing
Can be entered on a spoofed site and relayed.
Push approval
Vulnerable to phishing
Can be approved by a fatigued or misled user.
FIDO2 security key
Phishing-resistant
Bound to the authentic domain. Nothing to type, nothing to forward.
Questions regarding NIS2 and DORA
Does this apply to our organisation?
NIS2 and the Cybersecurity Act apply to medium and large entities across 18 sectors. These include energy, transport, healthcare, digital infrastructure, manufacturing, and public administration, as well as selected smaller critical operations. Book a walkthrough with us to quickly determine if you are in scope.
Are passkeys on a phone considered phishing-resistant?
Device-bound passkeys are phishing-resistant. Synced passkeys are a significant improvement over codes. However, for administrators and regulated roles, we recommend security keys.
Can we start with administrators only?
Yes. Many clients start with privileged accounts and third parties. They then roll it out to all staff.
See how your login withstands a real attack.
30 minutes with a Ciptor specialist. No slides you have already seen.
Book a walkthrough (30 min)