For investors
Go to MyFondia

Cybersecurity

Security has become a central part of how organisations manage their business, and the regulation governing it is continuously expanding and becoming stricter. With the help of our experts, you will navigate the complex regulatory framework on security.

How does security regulation affect organisations' operations?

Security threats targeting digital services, products and critical infrastructure are constantly growing. In addition to cyber threats, organisations must also prepare for physical risks, hybrid threats and disruptions in their operating environment. Security regulation obligations practically concern all organisations regardless of their industry. Organisations’ operations depend increasingly on functioning information systems, supply chains and critical services, and disruptions in these can have wide-reaching effects on both individual organisations and society as a whole. The EU has responded to this development by comprehensively reforming security and resilience regulation, and the new rules extend to an ever-greater number of sectors and organisations. Applying the new regulation to one’s own operations brings challenges, but also the opportunity to strengthen operational continuity and customer trust in a sustainable way.

Fondia’s lawyers help your company navigate the legal challenges and opportunities of security regulation.

We help our clients with, among other things:

  • We assess which security regulations apply to your company and to what extent

  • We draft and update internal guidelines and processes for risk management, resilience and incident notifications

  • We assist in evaluating the security requirements of supply chains and partners and in drafting contractual terms

  • We carry out contract reviews and update contract templates to comply with new security regulation

  • We support regulatory reporting and incident management

  • We train management and staff on security regulation and its practical implications

  • We assist in addressing cybersecurity requirements for digital products from the product design stage onwards

Background and current status of the NIS2 Directive

The NIS2 Directive (Directive (EU) 2022/2555) is EU legislation that aims to achieve a common high level of cybersecurity across the Union. It replaces the earlier NIS1 Directive and extends the scope of cybersecurity obligations to a wider range of sectors and organisations. The Directive has now been implemented , and organisations are subject to the relevant national legislation adopted by each EU Member State to give effect to it.

Who does the NIS2 Directive apply to?

The applicable national laws apply to entities classified as essential or important across sectors listed in NIS2's annexes, and as a rule, at least medium-sized enterprises fall within their scope. Each Member State has designated one or more competent authorities responsible for supervising compliance, and one or more CSIRTs (Computer Security Incident Response Teams) responsible for responding to and investigating incidents, as well as a national cybersecurity strategy and a framework for cyber crisis management.

Key obligations

The national laws require essential and important entities to implement appropriate and proportionate technical, operational and organisational measures to manage the cybersecurity risks to their network and information systems, covering areas such as risk analysis, incident handling, business continuity, supply chain security, and the security of network and information systems, and the management body must approve and oversee these measures and undergo related training. For significant incidents, an early warning must be submitted within 24 hours of becoming aware of the incident, a follow-up incident notification within 72 hours, and a final report within one month. Member States have designated competent authorities to supervise compliance, and non-compliance may result in administrative fines of up to EUR 10 million or 2% of global annual turnover for essential entities, and up to EUR 7 million or 1.4% of global annual turnover for important entities, whichever is higher.

How can Fondia help you?

We help you assess whether your company falls within the scope of the national laws as an essential or important entity, and build the risk management and reporting processes they require in practice, taking into account the specific national implementation applicable to your operations. Do not hesitate to contact our experts if you would like to discuss a question related to NIS2 in more detail.

Background and current status of the NIS2 Directive

The NIS2 Directive (Directive (EU) 2022/2555) is EU legislation that aims to achieve a common high level of cybersecurity across the Union. It replaces the earlier NIS1 Directive and extends the scope of cybersecurity obligations to a wider range of sectors and organisations. The Directive has now been implemented , and organisations are subject to the relevant national legislation adopted by each EU Member State to give effect to it.

Who does the NIS2 Directive apply to?

The applicable national laws apply to entities classified as essential or important across sectors listed in NIS2's annexes, and as a rule, at least medium-sized enterprises fall within their scope. Each Member State has designated one or more competent authorities responsible for supervising compliance, and one or more CSIRTs (Computer Security Incident Response Teams) responsible for responding to and investigating incidents, as well as a national cybersecurity strategy and a framework for cyber crisis management.

Key obligations

The national laws require essential and important entities to implement appropriate and proportionate technical, operational and organisational measures to manage the cybersecurity risks to their network and information systems, covering areas such as risk analysis, incident handling, business continuity, supply chain security, and the security of network and information systems, and the management body must approve and oversee these measures and undergo related training. For significant incidents, an early warning must be submitted within 24 hours of becoming aware of the incident, a follow-up incident notification within 72 hours, and a final report within one month. Member States have designated competent authorities to supervise compliance, and non-compliance may result in administrative fines of up to EUR 10 million or 2% of global annual turnover for essential entities, and up to EUR 7 million or 1.4% of global annual turnover for important entities, whichever is higher.

How can Fondia help you?

We help you assess whether your company falls within the scope of the national laws as an essential or important entity, and build the risk management and reporting processes they require in practice, taking into account the specific national implementation applicable to your operations. Do not hesitate to contact our experts if you would like to discuss a question related to NIS2 in more detail.

Background and current status of the Cyber Resilience Act

The Cyber Resilience Act (CRA) is a European Union regulation that establishes cybersecurity requirements for products with digital elements. The regulation is directly applicable law in all Member States and does not, for the most part, require separate national implementing legislation. In Finland, the Act on Cyber Resilience of Certain Products (439/2026), which specifies the national application of the CRA, has been in force since 1 June 2026.

Who does the Cyber Resilience Act apply to?

The regulation applies to all software or hardware products made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect connection to a device or network. The scope includes, for example, all internet-connected software and hardware products, such as Internet of Things devices and cybersecurity products, as well as more generally products with digital elements, such as embedded software, firmware or network connectivity. The obligations are directed at economic operators of products with digital elements, such as manufacturers, importers, distributors and conformity assessment bodies.

Key obligations and timeline

Manufacturers must ensure vulnerability handling processes throughout the expected lifetime of the product, maintain an information security management system, comply with minimum requirements such as security by design and security by default principles, and compliance is demonstrated by CE marking. Essential cybersecurity requirements apply in full from 11 December 2027, manufacturers’ reporting obligations under Article 14 will become applicable from 11 September 2026, and Chapter IV on notified bodies has been applicable since 11 June 2026. In Finland, the CSIRT unit receives mandatory vulnerability notifications and voluntary notifications, and the information may not be used against the notifier. Non-compliance may result in a sanction of up to EUR 15 million or 2.5% of global turnover.

How can Fondia help you?

We help you assess whether your products fall within the scope of the Cyber Resilience Act and build the necessary processes for product development regarding vulnerability management, reporting and CE marking well in advance of the deadlines.

Background and current status of the Cyber Resilience Act

The Cyber Resilience Act (CRA) is a European Union regulation that establishes cybersecurity requirements for products with digital elements. The regulation is directly applicable law in all Member States and does not, for the most part, require separate national implementing legislation. In Finland, the Act on Cyber Resilience of Certain Products (439/2026), which specifies the national application of the CRA, has been in force since 1 June 2026.

Who does the Cyber Resilience Act apply to?

The regulation applies to all software or hardware products made available on the market whose intended purpose or reasonably foreseeable use includes a direct or indirect connection to a device or network. The scope includes, for example, all internet-connected software and hardware products, such as Internet of Things devices and cybersecurity products, as well as more generally products with digital elements, such as embedded software, firmware or network connectivity. The obligations are directed at economic operators of products with digital elements, such as manufacturers, importers, distributors and conformity assessment bodies.

Key obligations and timeline

Manufacturers must ensure vulnerability handling processes throughout the expected lifetime of the product, maintain an information security management system, comply with minimum requirements such as security by design and security by default principles, and compliance is demonstrated by CE marking. Essential cybersecurity requirements apply in full from 11 December 2027, manufacturers’ reporting obligations under Article 14 will become applicable from 11 September 2026, and Chapter IV on notified bodies has been applicable since 11 June 2026. In Finland, the CSIRT unit receives mandatory vulnerability notifications and voluntary notifications, and the information may not be used against the notifier. Non-compliance may result in a sanction of up to EUR 15 million or 2.5% of global turnover.

How can Fondia help you?

We help you assess whether your products fall within the scope of the Cyber Resilience Act and build the necessary processes for product development regarding vulnerability management, reporting and CE marking well in advance of the deadlines.

Background and current status of the DORA Regulation

The DORA Regulation (Digital Operational Resilience Act) is an EU regulation specifically aimed at the financial sector, the objective of which is to strengthen the security of network and information systems supporting the business processes of financial markets. In Finland, the regulation has been directly applicable since 17 January 2025.

Who does the DORA Regulation apply to?

The DORA Regulation applies to financial entities such as banks, insurance companies, investment firms and payment institutions. The scope of the regulation is broad and covers almost all actors regulated under EU financial markets legislation. The Cybersecurity Act’s provisions on cybersecurity risk management, reporting, supervision or enforcement do not apply to financial sector entities. The DORA Regulation applies instead.

Key obligations

The provisions concern ICT risk management, reporting of major ICT-related incidents and voluntary notification of significant cyber threats, digital operational resilience testing, sharing of cyber threat and vulnerability information, and management of ICT third-party risk. For critical events, incidents must be reported within 4 hours, followed by an interim report within 24 hours and a monthly report. In Finland, the Finnish Financial Supervisory Authority acts as the competent authority under the DORA Regulation. Non-compliance may result in a sanction of up to EUR 10 million or 2% of turnover.

How can Fondia help you?

We help financial sector entities identify the scope of the DORA Regulation in their own operations and supplier networks, and update ICT risk management processes and third-party contracts to comply with the requirements of the regulation.

Background and current status of the DORA Regulation

The DORA Regulation (Digital Operational Resilience Act) is an EU regulation specifically aimed at the financial sector, the objective of which is to strengthen the security of network and information systems supporting the business processes of financial markets. In Finland, the regulation has been directly applicable since 17 January 2025.

Who does the DORA Regulation apply to?

The DORA Regulation applies to financial entities such as banks, insurance companies, investment firms and payment institutions. The scope of the regulation is broad and covers almost all actors regulated under EU financial markets legislation. The Cybersecurity Act’s provisions on cybersecurity risk management, reporting, supervision or enforcement do not apply to financial sector entities. The DORA Regulation applies instead.

Key obligations

The provisions concern ICT risk management, reporting of major ICT-related incidents and voluntary notification of significant cyber threats, digital operational resilience testing, sharing of cyber threat and vulnerability information, and management of ICT third-party risk. For critical events, incidents must be reported within 4 hours, followed by an interim report within 24 hours and a monthly report. In Finland, the Finnish Financial Supervisory Authority acts as the competent authority under the DORA Regulation. Non-compliance may result in a sanction of up to EUR 10 million or 2% of turnover.

How can Fondia help you?

We help financial sector entities identify the scope of the DORA Regulation in their own operations and supplier networks, and update ICT risk management processes and third-party contracts to comply with the requirements of the regulation.

Background and current status of the CER Directive

The CER Directive (Directive (EU) 2022/2557) is EU legislation that aims to improve the resilience of critical entities that provide services essential for the functioning of the internal market, the maintenance of vital societal functions or the safeguarding of public safety. The Directive has now been implemented, and organisations are subject to the relevant national legislation adopted by each EU Member State to give effect to it.

Who does the CER Directive apply to?

The applicable national laws cover eleven sectors, namely energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and food production, processing and distribution. Unlike the national laws implementing NIS2, these national laws take into account all types of risks, such as cyber risks, physical risks, hybrid threats, terrorism and natural disasters.

Key obligations

The national laws set out key obligations for critical entities relating to risk assessment, a resilience plan and ensuring resilience, and incident procedures. Entities must carry out a risk assessment, implement resilience measures and incident notifications, and Member States must draw up a four-year national plan. An incident must be notified immediately to the national authority, and if the incident affects at least six Member States, also to the Commission.

How can Fondia help you?

We help assess whether your company is considered a critical entity under the national laws, and support you in preparing risk assessments and resilience plans in cooperation with the competent authorities.

Background and current status of the CER Directive

The CER Directive (Directive (EU) 2022/2557) is EU legislation that aims to improve the resilience of critical entities that provide services essential for the functioning of the internal market, the maintenance of vital societal functions or the safeguarding of public safety. The Directive has now been implemented, and organisations are subject to the relevant national legislation adopted by each EU Member State to give effect to it.

Who does the CER Directive apply to?

The applicable national laws cover eleven sectors, namely energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and food production, processing and distribution. Unlike the national laws implementing NIS2, these national laws take into account all types of risks, such as cyber risks, physical risks, hybrid threats, terrorism and natural disasters.

Key obligations

The national laws set out key obligations for critical entities relating to risk assessment, a resilience plan and ensuring resilience, and incident procedures. Entities must carry out a risk assessment, implement resilience measures and incident notifications, and Member States must draw up a four-year national plan. An incident must be notified immediately to the national authority, and if the incident affects at least six Member States, also to the Commission.

How can Fondia help you?

We help assess whether your company is considered a critical entity under the national laws, and support you in preparing risk assessments and resilience plans in cooperation with the competent authorities.

Our Cybersecurity experts

Get to know our team of cybersecurity experts or contact them directly.

Henna Salo
Henna Salo
Senior Legal Counsel, Group Data Protection Lead
Arttu Ruukki
Arttu Ruukki
Senior Legal Counsel, AI and Data Economy Lead
Susanna Halmeensuo
Susanna Halmeensuo
Senior Legal Counsel
Roman Beletski
Roman Beletski
Senior Legal Counsel & Technologist
Tiina Kangas
Tiina Kangas
Senior Legal Counsel
Karoliina  Vesa
Karoliina Vesa
Legal Counsel
Emelie Zulfijaj
Emelie Zulfijaj
Senior Legal Counsel
Fredrik Niklasson
Fredrik Niklasson
Head of Legal Team, Senior Legal Counsel

How can we help you?

We’d love to hear more about your legal needs and talk about how we can help you solve them. Book a free meeting or call or email us.

Book a free meeting
Book a free meeting
Book a free meeting
Send an email or give us a call
Send an email or give us a call
Send an email or give us a call

We law your business.

Privacy⁠Privacy⁠
Cookies⁠Cookies⁠
CSR⁠CSR⁠
Contact us⁠Contact us⁠

Copyright © Fondia 2026. All rights reserved.