--- title: 2024, the year of cybersecurity regulations | SSH description: New and updated cybersecurity regulations (e.g. NIS2, DORA) place new demands on private as well as public organizations in 2024. --- [SSH Blog | Defensive Cybersecurity ](https://www.ssh.com/blog) # [2024, the year of cybersecurity regulations | SSH](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations) Written by [Zuzana Hutchinson](https://www.ssh.com/blog/author/zuzana-hutchinson) | Mar 7, 2024 10:54:35 AM The year 2024 will see several cybersecurity regulations and laws coming into effect – some of them are completely new (e.g. DORA), and some of them are new versions of older regulations (e.g. NIS2 or NIST 2.0). All of them placing new demands on private as well as public organizations, which will seriously affect the cybersecurity landscape.  Let’s look at the impact of new and updated cybersecurity regulations in 2024. ## Contents [Network and Information Security Directive 2.0 (NIS2)](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations?hs_amp=true#NIS2) [Digital Operational Resilience Act (DORA)](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations?hs_amp=true#DORA) [NIST Cyber Security Framework 2.0 (NIST 2.0)](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations?hs_amp=true#NIST-2.0) [The US government memorandums on PQC and Zero Trust cybersecurity](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations?hs_amp=true#PQC-ZeroTrust) [How to tackle cybersecurity regulations](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations?hs_amp=true#tackle-cybersecurity-regulations)   ## Network and Information Security Directive 2.0 (NIS2) The original [NIS Directive](https://www.ssh.com/academy/compliance/nis-directive) came into force in 2016. In 2024, it’s getting a major update that will be **in effect starting October 17, 2024**. **After that date, your organization can be sanctioned for non-compliance.**  The expanded NIS2 Directive is the EU’s response to the COVID-19 pandemic and the newly evolved cyberattack landscape. It affects primarily EU organizations tagged as “sectors of high criticality” and “essential services”, including:  - Governmental organizations  - Non-profits  - Banking and financial institutions  - Healthcare organizations  - Critical infrastructure (e.g. transportation, energy, water supply)  - Manufacturing (e.g. food production and manufacturing, critical products like medical devices, computers, or machinery)  - Digital infrastructure and digital service providers [Browse the full list of affected industries here >>>](https://www.ssh.com/academy/compliance/nis2-directive#Does-nis2-affect-your-org)  **Note that the NIS2 Directive also affects non-EU organizations that operate in the EU.** ## Digital Operational Resilience Act (DORA) DORA is an EU regulation that won’t be in effect during 2024, but organizations still need to prepare for it as **it will be applied from January 17, 2025**. **DORA aims to improve the operational resilience and cybersecurity of financial institutions**, including banks, insurance companies, investment firms, payment service providers, and other entities engaged in financial services.  The focus is on areas such as risk management, third-party risk management, incident management and reporting, testing of resilience and security setups, and information sharing between institutions.  [Read more about the focus areas here >>>](https://www.ssh.com/academy/compliance/digital-operational-resilience-act-dora#main-features)  ## NIST Cyber Security Framework 2.0 (NIST 2.0) This is an update to the original NIST Framework which was published in 2014 and focused only on critical infrastructure. The NIST 2.0 Framework has a much wider audience – in fact, **it aims to help all organizations improve their cybersecurity posture and reduce related risks**.  Even though the Framework is a **voluntary **regulation, it is widely used as it provides companies with concrete guidance and step-by-step instructions on how to better their security.  **NIST 2.0 was published on February 26, 2024**, and [you can find the full document here >>>](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)  ## The US government memorandums on PQC and Zero Trust cybersecurity The US government is also making crucial moves in the cybersecurity field. In 2022, the Executive Office of the President published two memorandums, outlining [the migration to Post-Quantum Cryptography (PQC)](https://www.whitehouse.gov/wp-content/uploads/2022/11/M-23-02-M-Memo-on-Migrating-to-Post-Quantum-Cryptography.pdf) and [Zero Trust cybersecurity principles](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf).  This year, **federal agencies face the first important deadline – September 30, 2024**. By that date, they must have Zero Trust architecture in place.  The migration to PQC is primarily informed by the [NIST PQC standardization process](https://csrc.nist.gov/projects/post-quantum-cryptography), which started in 2016. And the National Institute of Standards and Technology (NIST) currently aims to release the first standards during 2024, which means that US governmental and federal agencies are kept on their toes, waiting for the latest updates and deadlines.    ## Tackle cybersecurity regulations with the help of experts from SSH Communications Security Cybersecurity regulations and laws are nothing new to the experts at SSH Communications Security. In fact, we helped to develop several of them – as the inventors of the Secure Shell protocol, we stood at the forefront of inventing secure internet as we know it today.  We offer a comprehensive risk assessment and professional services that will help you achieve compliance and stay compliant.  [Learn more about our SSH Risk Assessment >>>](https://www.ssh.com/products/ssh-risk-assessment/)  [Browse the variety of professional services we offer >>>](https://www.ssh.com/products/services/)          [View full post](https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations) ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Zuzana Hutchinson" }, "dateModified" : "2024-03-07T10:54:36.129Z", "datePublished" : "2024-03-07T10:54:35Z", "headline" : "2024, the year of cybersecurity regulations", "image" : { "@type" : "ImageObject", "height" : 1250, "url" : "https://www.ssh.com/hubfs/Social/CS_regulations_2024.jpg", "width" : 2500 }, "mainEntityOfPage" : "https://www.ssh.com/blog/2024-the-year-of-cybersecurity-regulations", "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : 60.0, "url" : "https://www.ssh.com/hubfs/ssh_logo_black_tight.png", "width" : 225.17857 }, "name" : "SSH Blog" } } ```