EU cybersecurity, NIS2, DORA, and threat-intelligence guides for European CISOs and compliance leads.https://www.riskletters.eu/enhttps://www.riskletters.eu/blog/hubbard-cyber-risk-quantification/https://www.riskletters.eu/blog/hubbard-cyber-risk-quantification/Doug Hubbard's calibrated estimation plus Monte Carlo simulation is the methodological core of modern cyber risk quantification. How calibration training works, how Monte Carlo turns ranges into distributions, and how this pairs with FAIR.Fri, 09 Oct 2026 00:00:00 GMTrisk-quantificationhubbardcalibrationmonte-carloguidehttps://www.riskletters.eu/blog/fair-methodology-explained/https://www.riskletters.eu/blog/fair-methodology-explained/FAIR (Factor Analysis of Information Risk) is the most widely adopted ontology for quantifying cyber risk. How its decomposition works, how it pairs with Monte Carlo simulation, and how to apply it without a statistician on staff.Fri, 02 Oct 2026 00:00:00 GMTrisk-quantificationfairopen-fairontologyguidehttps://www.riskletters.eu/blog/qualitative-risk-assessment-problems/https://www.riskletters.eu/blog/qualitative-risk-assessment-problems/Why the qualitative grid is losing ground to quantitative methods — and what to replace it with.Fri, 25 Sep 2026 00:00:00 GMTrisk-quantificationheat-mapqualitative-riskguidehttps://www.riskletters.eu/blog/cyber-risk-quantification/https://www.riskletters.eu/blog/cyber-risk-quantification/A pillar guide to cyber and operational risk quantification in 2026 — FAIR, Hubbard, Monte Carlo, Bayesian methods, loss exceedance curves, and how regulators under DORA and NIS2 increasingly expect numbers, not heat maps.Fri, 18 Sep 2026 00:00:00 GMTrisk-quantificationfairhubbardmonte-carloguidepillar-pagehttps://www.riskletters.eu/blog/gdpr-processor-due-diligence-nis2/https://www.riskletters.eu/blog/gdpr-processor-due-diligence-nis2/GDPR Article 28 governs your data processors; NIS2 Article 21(2)(d) governs your suppliers; DORA Articles 28-30 govern your ICT third parties. They overlap heavily. How to run one supplier programme that satisfies all three.Fri, 11 Sep 2026 00:00:00 GMTgdprdata-processordue-diligencenis2supply-chainguidehttps://www.riskletters.eu/blog/gdpr-international-data-transfers/https://www.riskletters.eu/blog/gdpr-international-data-transfers/Moving personal data outside the EU under GDPR Chapter V — adequacy decisions, Standard Contractual Clauses, transfer impact assessments after Schrems II, and why EU-based data processing is becoming a commercial decision, not just a legal one.Fri, 04 Sep 2026 00:00:00 GMTgdprinternational-transferssccdata-residencyguidehttps://www.riskletters.eu/blog/gdpr-international-transfers/https://www.riskletters.eu/blog/gdpr-international-transfers/Moving personal data outside the EU under GDPR Chapter V — adequacy decisions, Standard Contractual Clauses, transfer impact assessments after Schrems II, and why EU-based data processing is becoming a commercial decision, not just a legal one.Fri, 04 Sep 2026 00:00:00 GMTgdprinternational-transferssccdata-residencyguidehttps://www.riskletters.eu/blog/gdpr-dpia-explained/https://www.riskletters.eu/blog/gdpr-dpia-explained/The Data Protection Impact Assessment under GDPR Article 35 — when it's mandatory, how to run one, and how it overlaps with NIS2 and DORA risk assessment so you build one process instead of three.Fri, 28 Aug 2026 00:00:00 GMTgdprdpiarisk-assessmentnis2guidehttps://www.riskletters.eu/blog/gdpr-breach-notification-nis2-dora/https://www.riskletters.eu/blog/gdpr-breach-notification-nis2-dora/A personal data breach at a regulated entity can trigger GDPR, NIS2 and DORA reporting at once — three authorities, three templates, three clocks. How the obligations differ, where they overlap, and how to run them from one incident record.Fri, 21 Aug 2026 00:00:00 GMTgdprbreach-notificationnis2doraincident-reportingguidehttps://www.riskletters.eu/blog/gdpr-nis2-dora-intersection/https://www.riskletters.eu/blog/gdpr-nis2-dora-intersection/European organisations face GDPR, NIS2 and DORA at once — and the regimes overlap in incident reporting, supply chain, governance and security measures. A guide to where they intersect, where they conflict, and how to build one programme that satisfies all three.Fri, 14 Aug 2026 00:00:00 GMTgdprnis2doraguidepillar-pagehttps://www.riskletters.eu/blog/dora-register-of-information-template/https://www.riskletters.eu/blog/dora-register-of-information-template/The DORA Register of Information under Article 28(3) — what it is, the structure prescribed by Implementing Regulation 2024/2956, the templates and data fields, common errors, and how to build and maintain it.Fri, 07 Aug 2026 00:00:00 GMTdoraregister-of-informationthird-partyarticle-28guidehttps://www.riskletters.eu/blog/dora-third-party-oversight/https://www.riskletters.eu/blog/dora-third-party-oversight/DORA Pillar 4 — Articles 28 to 30 — is the operationally heaviest part of the regulation. Pre-contractual risk assessment, mandatory contractual provisions, concentration risk, and the critical ICT third-party provider oversight regime, explained.Fri, 31 Jul 2026 00:00:00 GMTdorathird-partypillar-4ict-vendorsguidehttps://www.riskletters.eu/blog/nis2-supply-chain-requirements/https://www.riskletters.eu/blog/nis2-supply-chain-requirements/NIS2's supply chain obligation is one paragraph that creates a programme of work. What Article 21(2)(d) requires, how to build a supplier register and due-diligence process, the contractual clauses you need, and what suppliers themselves should expect.Fri, 24 Jul 2026 00:00:00 GMTnis2supply-chainarticle-21third-partyguidehttps://www.riskletters.eu/blog/nis2-penalties-by-country/https://www.riskletters.eu/blog/nis2-penalties-by-country/The NIS2 penalty framework under Article 34, plus how it actually varies across member states — fine ceilings, personal liability, registration deadlines, and early enforcement patterns in Germany, the Netherlands, France, Belgium, and beyond.Fri, 17 Jul 2026 00:00:00 GMTnis2penaltiesenforcementarticle-34guidehttps://www.riskletters.eu/blog/nis2-essential-vs-important-entities/https://www.riskletters.eu/blog/nis2-essential-vs-important-entities/The scope test that determines half of your NIS2 obligations. Annex I vs Annex II, the size threshold, the size-irrelevant categories, and how the two-tier supervision model actually works.Fri, 10 Jul 2026 00:00:00 GMTnis2scopeessential-entityimportant-entityguidehttps://www.riskletters.eu/blog/dora-ict-risk-management/https://www.riskletters.eu/blog/dora-ict-risk-management/DORA's first and largest pillar — Articles 5 to 14 — sets the ICT risk management framework for every EU financial entity. Governance, lifecycle, BCM, learning. What's mandatory, what's prescriptive, and how it differs from NIS2 Article 21.Fri, 03 Jul 2026 00:00:00 GMTdoraict-riskpillar-1guidehttps://www.riskletters.eu/blog/nis2-personal-liability-explained/https://www.riskletters.eu/blog/nis2-personal-liability-explained/Article 20 NIS2 puts the management body on the hook for cybersecurity oversight. What that means in practice, where personal liability applies, and the country-by-country variations every European board needs to know.Fri, 26 Jun 2026 00:00:00 GMTnis2governancearticle-20liabilityguidehttps://www.riskletters.eu/blog/nis2-incident-reporting-timeline/https://www.riskletters.eu/blog/nis2-incident-reporting-timeline/How NIS2 Article 23 works in practice — the 24-hour early warning, 72-hour notification, and 1-month final report. What each contains, who you report to, and where the clock actually starts.Fri, 19 Jun 2026 00:00:00 GMTnis2incident-reportingarticle-23guidehttps://www.riskletters.eu/blog/minimum-viable-nis2-sme/https://www.riskletters.eu/blog/minimum-viable-nis2-sme/A pragmatic NIS2 compliance roadmap for 50–249 employee European SMEs — 5 priorities mapped to Article 21, a 90-day plan, realistic cost ranges, and the proportionality principle that makes minimum viable defensible.Fri, 12 Jun 2026 00:00:00 GMTnis2guidesmeimplementationhttps://www.riskletters.eu/blog/nis2-compliance-denmark/https://www.riskletters.eu/blog/nis2-compliance-denmark/Everything Danish companies need to know about NIS2 implementation: NIS-2-loven (L 141), CFCS registration, the 6,000 in-scope entities, and how Denmark deviates from the directive.Fri, 05 Jun 2026 00:00:00 GMTnis2country-trackerdenmarkguidehttps://www.riskletters.eu/blog/nis2-article-21-explained/https://www.riskletters.eu/blog/nis2-article-21-explained/A practitioner's guide to the 10 risk management measures required under NIS2 Article 21 — what each means, the minimum SME evidence pack, and the proportionality principle most articles miss.Fri, 29 May 2026 00:00:00 GMTnis2guidearticle-21risk-managementhttps://www.riskletters.eu/blog/trust-supply-chain-four-risks/https://www.riskletters.eu/blog/trust-supply-chain-four-risks/How a single compromised ICT provider can be a cyber incident, a financial concentration risk, a geopolitical exposure, and a regulatory obligation simultaneously under NIS2 and DORA.Tue, 26 May 2026 00:00:00 GMTthreat-intelcross-domain-risksupply-chaindoranis2geopolitical-riskhttps://www.riskletters.eu/blog/apt29-cozy-bear-profile/https://www.riskletters.eu/blog/apt29-cozy-bear-profile/A profile of APT29, the SVR-affiliated Russian threat group known as Cozy Bear and Midnight Blizzard. Long-term strategic intelligence collection, the SolarWinds and Microsoft intrusions, supply-chain tradecraft, and what European NIS2 and DORA entities should learn from a quieter adversary.Tue, 26 May 2026 00:00:00 GMTthreat-intelthreat-actor-profileapt29cozy-bearrussiasvrnis2espionagehttps://www.riskletters.eu/blog/apt28-fancy-bear-profile/https://www.riskletters.eu/blog/apt28-fancy-bear-profile/A profile of APT28, the Russian GRU-affiliated threat group also known as Fancy Bear, Forest Blizzard, and UAC-0001. History, recent 2025-2026 campaigns including Operation MacroMaze and CVE-2026-21509 exploitation, sectors targeted, and what NIS2 and DORA entities should learn from its tradecraft.Tue, 26 May 2026 00:00:00 GMTthreat-intelthreat-actor-profileapt28fancy-bearrussiagrunis2espionagehttps://www.riskletters.eu/blog/lockbit-ransomware-profile/https://www.riskletters.eu/blog/lockbit-ransomware-profile/A profile of LockBit, the ransomware-as-a-service operation that survived the 2024 international law-enforcement takedown and continues to extort European NIS2 and DORA entities. Affiliate model, recent campaigns, and what defenders should learn from its persistence.Tue, 26 May 2026 00:00:00 GMTthreat-intelthreat-actor-profilelockbitransomwareraasnis2dorahttps://www.riskletters.eu/blog/murky-panda-china-profile/https://www.riskletters.eu/blog/murky-panda-china-profile/A profile of MURKY PANDA, the China-nexus threat actor named in CrowdStrike's 2026 Financial Services Threat Landscape Report. Operating across 36 countries against 340 organisations in 30 sectors, with financial services among the most frequently hit. What European DORA entities should learn from its tradecraft.Tue, 26 May 2026 00:00:00 GMTthreat-intelthreat-actor-profilemurky-pandachinafinancial-sectordoraespionagehttps://www.riskletters.eu/blog/ict-supply-chain-trust-risk/https://www.riskletters.eu/blog/ict-supply-chain-trust-risk/A single compromised ICT provider is simultaneously a cyber incident, a financial concentration risk, a geopolitical exposure, and a regulatory obligation under DORA and NIS2. A cross-domain analysis of why modern financial risk refuses to stay in its lane.Tue, 26 May 2026 00:00:00 GMTthreat-intelcross-domain-risksupply-chaindoranis2geopolitical-riskhttps://www.riskletters.eu/blog/lazarus-group-north-korea-profile/https://www.riskletters.eu/blog/lazarus-group-north-korea-profile/A profile of Lazarus Group, North Korea's state-sponsored cyber operation responsible for billions in cryptocurrency theft, financial-sector intrusions, and supply-chain attacks. Tradecraft, history, recent campaigns, and what European NIS2 and DORA entities should take from it.Tue, 26 May 2026 00:00:00 GMTthreat-intelthreat-actor-profilelazarusnorth-koreadprkcryptocurrencydorafinancialhttps://www.riskletters.eu/blog/nis2-vs-dora-key-differences/https://www.riskletters.eu/blog/nis2-vs-dora-key-differences/A side-by-side comparison of NIS2 and DORA: scope, legal mechanism, risk management, incident reporting, third-party rules, and penalties. Plus: when both apply to you and which one wins.Fri, 22 May 2026 00:00:00 GMTnis2doracomparisonguidehttps://www.riskletters.eu/blog/nis2-dora-compliance/https://www.riskletters.eu/blog/nis2-dora-compliance/Everything European SMEs need to know about NIS2 and DORA in 2026: who's in scope, the 10 Article 21 measures, the 24-72-30 incident timeline, DORA's 5 pillars, penalties, and a 10-step path to compliance. Updated quarterly.Fri, 15 May 2026 00:00:00 GMTnis2doraguidepillar-pagesme