Cybersecurity Compliance and Regulations | Securevalley

July 2, 2026 · Nouh Droussi · Cybersécurité · Maroc · 4 min read · Updated September 26, 2026

NIS 2, DORA, GDPR, Law 05-20: how to identify the texts that apply, map them to one control framework and keep audit evidence up to date.

Cybersecurity compliance means demonstrating that your organisation meets the security obligations that apply to it, whether they come from laws, sector regulations, contracts or standards chosen voluntarily. The most efficient approach is to identify which texts apply, map their requirements to a single set of controls, and run that set through a management system that produces evidence continuously. Compliance then supports security instead of competing with it.

Laws, regulations and standards: different natures

The texts that security teams deal with do not carry the same weight:

• laws and regulations are mandatory for the entities in their scope and are enforced by an authority, with possible sanctions;
• standards such as ISO/IEC 27001 are voluntary, but often become required through contracts, tenders or regulators that recognise them;
• frameworks such as the NIST Cybersecurity Framework (CSF) 2.0 provide a structure and vocabulary to organise and communicate security outcomes, without certification.

Understanding this difference helps prioritise: a legal obligation with a reporting deadline cannot wait, while a framework can be adopted progressively.

Texts that frequently apply

Several texts appear in most compliance discussions for organisations working in or with Europe and North Africa.

• NIS 2 Directive (EU) 2022/2555. It had to be transposed by Member States by 17 October 2024 and covers medium and large entities in 18 sectors, including energy, transport, health, finance, digital infrastructure and public administration. It requires risk-management measures, incident reporting in stages (an early warning within 24 hours, a notification within 72 hours and a final report within one month) and makes management bodies accountable.
• DORA, Regulation (EU) 2022/2554. It has applied since 17 January 2025 to financial entities in the EU. Its main areas are ICT risk management, incident management and reporting, resilience testing, management of ICT third-party risk and oversight of critical ICT providers.
• GDPR. It requires appropriate security for personal data and notification of personal data breaches to the supervisory authority, where required, within 72 hours of becoming aware of them.
• In Morocco, Law 05-20 on cybersecurity and its implementing Decree 2-21-406 of 15 July 2021 apply to state administrations, public bodies, operators of critical infrastructures of vital importance and certain private providers such as telecom and digital service operators. The decree sets security rules, audit requirements for sensitive systems and a qualification scheme for audit and incident response providers, under the authority of the DGSSI. Law 09-08 on personal data protection, supervised by the CNDP, adds privacy obligations.

Entities outside the EU are not automatically out of scope: a Moroccan subsidiary, supplier or service provider to an EU entity subject to NIS 2 or DORA will often receive these requirements through contracts.

Building a unified control framework

Handling each text separately leads to duplicated work and inconsistent answers to auditors. A more robust method is to build one control framework:

• list applicable obligations with their source, scope and deadlines;
• choose a reference structure, for example ISO/IEC 27001 and its Annex A, or the CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover);
• map each legal or contractual requirement to existing controls and identify gaps;
• assign an owner to each control and define the evidence that proves it operates.

Many requirements overlap. Access control, logging, vulnerability management, backup, incident response and supplier security appear in almost every text. Documented once and tested regularly, they serve several obligations at the same time.

Risk management at the centre

Recent regulations are written around risk. NIS 2 asks for measures that are appropriate and proportionate to the risks, DORA requires an ICT risk management framework, and ISO/IEC 27001 is built on risk assessment and treatment. This means a compliance programme needs a documented and repeatable risk method, such as the approach described in ISO/IEC 27005 or the EBIOS Risk Manager method published by ANSSI.

A clear risk register also helps explain decisions to management and auditors: why a control was chosen, why a residual risk was accepted and who approved it.

Evidence, audits and continuous monitoring

Auditors and regulators look for proof. Plan for it from the start:

• keep policies and procedures versioned and approved;
• retain logs, change records, access reviews and test results for a defined period;
• run internal audits and management reviews on a fixed schedule;
• test incident response and reporting procedures against the actual regulatory deadlines;
• track corrective actions until they are closed.

Where possible, automate evidence collection from security tools, for example configuration compliance reports or vulnerability scan history. Continuous monitoring reduces the effort of each audit and exposes drift before it becomes a finding.

Skills and training

Compliance programmes need people who can read regulations and translate them into controls. The ISO/IEC 27001 Lead Implementer training covers building an ISMS that can serve as the backbone for several obligations. Entities in scope of the European directive can follow the NIS 2 Directive Lead Implementer training, and financial entities can prepare for DORA with the DORA Lead Manager training.

Conclusion

Cybersecurity compliance is manageable when it is treated as one programme rather than a series of separate projects. Identify the texts that apply, map them to a single control framework, place risk management at the centre and collect evidence continuously. This approach reduces audit effort and, more importantly, improves actual security.