Securing critical infrastructure: Why Europe’s risk-based regulations matter

The article explains how Europe’s new risk-based cybersecurity regulations, NIS2 and DORA, are reshaping the role of CISOs by expanding oversight across IT, OT, IoT and the supply chain, with directors now responsible for approving and supervising the required measures. It argues that the regulations are prescriptive, embedding specific mitigations like multifactor authentication, cryptography and supply chain security, while emphasising a risk-based approach and the need to preserve resilience.

According to Microsoft’s 2025 Digital Defense Report, cybercriminals are highly capable and expanding their operations, with more than 97% of identity attacks being password attacks and identity-based attacks up by 32% in the first half of 2025, underscoring where protection should focus. The piece notes that phishing-resistant multifactor authentication can stop more than 99% of these attacks, illustrating the impact of prioritised controls.

It concludes that the bottom line is to implement a focused set of high-impact measures, measure their effectiveness, and use key control indicators to inform board-level oversight.