Compliance & AssuranceEU Regulation
If you have EU subsidiaries, customers or supply-chain links, European cyber regulation may reach you. We help you scope the obligations, close the gaps and build the reporting and resilience processes NIS 2 and DORA require.
01Overview
NIS 2 is the European Union's directive on the security of network and information systems, setting cyber risk management and incident reporting duties for essential and important entities across many sectors. DORA is the EU's Digital Operational Resilience Act, which applies to financial entities and their critical ICT service providers, and has applied since 17 January 2025.
Possibly, if you have EU entities, operate essential services in the EU, or provide ICT services to EU financial entities.
Risk management measures, management accountability, fast incident reporting, supply-chain security and, under DORA, resilience testing.
Significant fines, which for NIS 2 can reach millions of euros or a percentage of turnover, plus supervisory measures.
They overlap. A unified control set can cover most requirements.
02What we do
Choose the regulation that applies, or both.
For entities in energy, transport, banking, health, water, digital infrastructure, ICT services and other sectors.
What you receive
A defensible NIS 2 position.
For banks, insurers, investment firms, payment institutions and critical ICT providers to them.
What you receive
A DORA programme you can evidence.
Governance, supply-chain and incident capabilities shared across regulations and your Saudi frameworks.
What you receive
Less duplication.
Scenario-based and threat-led testing in line with DORA expectations.
What you receive
Testing evidence for supervisors.
03How we work
Start by confirming whether the rules apply.
Step 1 · Weeks 1 to 2
Entities, services and customers in the EU.
Step 2 · Weeks 2 to 6
Gap against NIS 2 and DORA.
Step 3 · Week 7
Roadmap aligned with existing frameworks.
Step 4 · Months 3 to 7
Policies, processes and registers.
Step 5 · Months 6 to 8
Incident reporting and resilience tests.
Step 6 · Month 9
Documentation for supervisors.
04Reference
Two European regimes with common roots.
| NIS 2 | DORA | |
|---|---|---|
| Type | EU directive, implemented by member states | EU regulation, directly applicable |
| Applies from | Transposition deadline 17 October 2024 | 17 January 2025 |
| Who | Essential and important entities in listed sectors | Financial entities and critical ICT third-party providers |
| Incident reporting | Early warning 24 hours, notification 72 hours, final report in one month | Major ICT incident reporting on defined timelines |
| Testing | Risk-based measures | Regular resilience testing, with threat-led testing for significant entities |
| Third parties | Supply-chain security | ICT third-party register, contracts and oversight |
Summary of public legal texts. Obtain legal advice on applicability.
05Saudi Arabia and the GCC
Borders do not stop regulation.
Operations in the EU fall directly under member-state laws.
EU entities must pass requirements on to their suppliers, including those outside the EU.
Gulf banks with European arms may face DORA through those entities.
NCA ECC, SAMA CSF and ISO 27001 evidence helps meet many requirements.
06Why GoAgile
Regional knowledge, European requirements.
Talk to a security specialistA clear answer on whether you are in scope.
Saudi and EU controls mapped together.
Multiple clocks, one process.
Threat-led testing in-house.
Credentials
07Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
The authority had to demonstrate compliance with the NCA Essential Cybersecurity Controls and did not know where to start.
Result: A clear compliance position, a funded roadmap and audit-ready evidence.
Patient data sat in many systems, with no single record of what was held, why, or who could see it.
Result: A defensible PDPL position and a process the privacy team could run day to day.
Enterprise customers were asking for a SOC 2 report the company did not yet have.
Result: The audit completed with the report customers had asked for.
Client names are withheld for confidentiality.
08Related services
Each service stands alone and works better with the others.
Tell us where you operate. We will give you a scoped view of NIS 2 and DORA exposure.
Check my EU exposure09Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.