Two European regulations have changed what organizations are expected to prove about their security. NIS2 broadens the scope of cybersecurity obligations across a wide range of sectors and supply chains. DORA sets operational resilience requirements for financial entities and the technology providers they depend on. Both share a common theme: it is no longer enough to have security controls. You have to be able to evidence that they work, continuously, and to report when they fail.
DNS sits awkwardly inside these requirements. It is rarely named explicitly, which leads many teams to assume it falls outside scope. In practice, DNS underpins several things both regulations care about a great deal: asset inventory, supply chain dependencies, incident detection, and service continuity. If your DNS is unmonitored, you have a gap in exactly the areas an assessor will probe.
This article covers what NIS2 and DORA expect in general terms, where DNS intersects those expectations, and how to prepare. It is a practical guide rather than a legal one, and the note at the end explains why you should treat it that way.
What the Two Regulations Are Asking For
The two frameworks differ in scope and detail, but for the purposes of DNS preparation their demands converge.
