Loading story…
European organizations are facing significant challenges in implementing the NIS2 Directive, with many CISOs reporting that compliance efforts are being hampered by excessive documentation requirements and unclear regulatory expectations. The process often results in a heavy administrative burden, where compliance is measured by the ability to produce extensive paperwork rather than demonstrable improvements in actual security posture. This disconnect between regulatory intent and practical outcomes has led to concerns that the focus on documentation may not translate into meaningful risk reduction.
A recent study highlights that NIS2 is projected to reach around 70% adoption by the end of 2025, which is lower than other frameworks such as HIPAA and GDPR but higher than PCI DSS. The study attributes this to the stronger enforcement mechanisms of NIS2, which, like GDPR and HIPAA, relies on public authorities for oversight and sanctions, as opposed to the contractual enforcement model of PCI DSS. The comparison underscores the importance of independent regulatory oversight in driving compliance and suggests that while NIS2's adoption is progressing, the effectiveness of its implementation remains a concern due to the administrative complexities involved.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
An article published in late 2025 described how organizations can implement NIS2 through automation, Infrastructure as Code, and DevSecOps rather than manual documentation-heavy processes. It highlighted identity and access management, vulnerability management, and incident reporting as areas where embedded technical controls can improve both compliance and security outcomes.
A report published in late 2025 argued that PCI DSS adoption remains low because enforcement is handled indirectly by acquiring banks and lacks the strong, independent oversight seen in public regulatory regimes. It recommended stronger enforcement authority, clearer guidance, and greater transparency, including possible public disclosure of compliance status.
A study found that only about 32% of organizations were fully compliant with PCI DSS requirements in 2022. The report said this represented a decline from 2020 and trailed compliance levels seen under frameworks such as HIPAA, GDPR, and NIS2.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The NIS2 Directive has introduced new, binding cybersecurity requirements for organizations across the European Union, emphasizing that cybersecurity is a core business risk requiring executive-level oversight. The directive mandates enhanced risk management, supply chain security, incident response, and reporting measures, as well as increased management accountability. In Spain, NIS2 became binding in January, prompting organizations to adopt modern security technologies and integrate comprehensive strategies to protect sensitive data and ensure regulatory compliance. Industry leaders highlight the need for systematic approaches to compliance and stress that IT risks must be managed as business risks under the new regulatory landscape.
Jun 29, 2026
European and UK regulatory pressure is pushing cybersecurity from an IT function into **board-level accountability**, with frameworks like **NIS2** and UK cyber resilience policy expectations emphasizing management oversight and demonstrable cyber-risk governance. Reporting focused on operational metrics (e.g., patch counts, vulnerability totals, tool deployment) is increasingly viewed as insufficient for executives because it does not show whether enterprise risk exposure is trending up or down; guidance and industry outlooks highlight the need for measurable, business-aligned KPIs that support defensible oversight and investment decisions. Cloud environments amplify this governance challenge because **unknown or unmanaged assets** (shadow accounts, orphaned identities, forgotten data stores, and third-party integrations) can sit outside monitoring, IAM governance, and incident response processes, creating “invisible” attack surface and compliance exposure. A commonly cited failure pattern is data exposure from an abandoned or untracked cloud subscription where no sophisticated exploit is required—risk materializes because the organization cannot inventory what it owns—reinforcing that real-time asset discovery and visibility are prerequisites for credible cloud security and board reporting.
Jul 12, 2026
Amazon Web Services (AWS) has announced the AWS European Sovereign Cloud, a new independent cloud infrastructure designed to address the unique sovereignty, security, and compliance requirements of European public sector organizations and highly regulated industries. The AWS European Sovereign Cloud incorporates the Sovereign Reference Framework (ESC-SRF), which aligns with governance, operational control, data residency, and technical isolation criteria, and is undergoing independent third-party audits to validate its compliance with European regulatory expectations. AWS is also making the ESC-SRF available through AWS Artifact, enabling customers and partners to build upon these sovereignty controls for their own compliance needs. In parallel, AWS has reaffirmed its commitment to supporting customers in meeting the requirements of the EU's NIS 2 Directive, which aims to strengthen cybersecurity across the Union. As NIS 2 is transposed into national law across EU member states, AWS is working closely with national cybersecurity authorities and customers to ensure robust security practices and compliance. These efforts are part of AWS's broader responsibility to secure digital infrastructure in Europe and to help organizations build resilience and trust in the online environment.
Jun 29, 2026