Lesson 2.60: Regulatory horizon scanning
New cyber regulation arrives every year, often with long lead times and staggered deadlines: the EU's NIS2 (applied from October 2024), DORA for financial entities (from 17 January 2025), the Cyber Resilience Act for products with digital elements (in force since 10 December 2024, reporting obligations from 11 September 2026, most obligations from 11 December 2027) and the AI Act. Each applies to some business units and not others. A horizon-scanning tracker turns that into owners and dates. In the lab you read Northwind's tracker, find obligations nobody owns, obligations already late, and the next deadlines, and assign them.
19 min
You will learn to
- Explain horizon scanning and why deadlines are staggered
- Map regulations to business units
- Find obligations without owners
- Find obligations already in force but not done
- Plan for upcoming deadlines
Key terms
- Horizon scanning
- Tracking upcoming regulation and preparing before it applies.
- DORA
- EU Digital Operational Resilience Act for financial entities; applies from 17 January 2025.
- Cyber Resilience Act (CRA)
- EU regulation on cybersecurity of products with digital elements; in force 10 Dec 2024, reporting from 11 Sep 2026, main obligations from 11 Dec 2027.
- EU AI Act
- Risk-based EU regulation on AI; most high-risk obligations apply from 2 August 2026.
- Applicability
- Whether, and to which part of the business, a law applies.
← Security dashboards: garbage in, garbage out · All lessons · Security in the first 100 days after an acquisition →