By May 2026, three operational resilience regimes are running in parallel for any institution with cross-border activity. The European Union Digital Operational Resilience Act is now in its second year of full application. The Network and Information Security Directive 2 has reached enforcement maturity in most member states. The Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, supplemented by the Cyber Resilience Review, remains the dominant United States supervisory instrument. The United Kingdom Prudential Regulation Authority Supervisory Statement 1/21 on operational resilience continues to set the standard for important business services and impact tolerances.
Read in isolation, each regime appears bespoke. Read together, the substantive overlap exceeds seventy percent. The vocabulary differs. The control objectives do not. An institution that builds three parallel programmes pays for the same control three times and demonstrates it in three different formats. An institution that maps the regimes to a single scoring model demonstrates each one from a single control inventory.
DORA Article 6 requires a documented information and communication technology risk management framework, approved by the management body, reviewed at least annually, and integrated with the institution's overall risk strategy. NIS2 Article 21 requires technical, operational and organisational measures to manage cybersecurity risks, listed across ten domains including supply chain, incident handling, business continuity and the use of cryptography. FFIEC CAT defines an inherent risk profile across five categories and a cybersecurity maturity assessment across five domains. The control objectives that satisfy DORA Article 6 satisfy NIS2 Article 21 and the FFIEC maturity domains, when expressed at the right level of granularity.
Third-party oversight is the area of sharpest convergence. DORA Article 28 requires institutions to maintain a register of contractual arrangements with ICT third-party service providers, to perform pre-contractual due diligence, to embed mandatory contractual clauses including audit rights and exit clauses, and to conduct exit testing for critical or important functions. NIS2 supply-chain provisions require equivalent due diligence and contractual coverage. FFIEC outsourcing guidance imposes substantively the same expectations. A single third-party risk programme can evidence all three.
Severe but plausible scenarios are the second area of convergence. DORA Article 25 requires advanced threat-led penetration testing for significant institutions, plus annual scenario-based testing for the broader population. The European Central Bank threat-intelligence-based ethical red-teaming framework, TIBER-EU, provides the methodology. The FFIEC Cyber Resilience Review tests against business-disruption scenarios that map closely to the DORA scenario catalogue. The United Kingdom CBEST regime continues to provide the closest available analogue. Institutions that maintain one scenario library, tagged to each regime's terminology, run a single testing programme rather than three.
Important business services under PRA SS1/21 and critical or important functions under DORA Article 8 are the third area. The PRA framework requires institutions to identify the services that, if disrupted, would harm consumers or threaten market stability, set impact tolerances expressed in time and other metrics, perform mapping of resources, and test against severe but plausible scenarios. DORA requires identification of critical or important functions, mapping to ICT systems and third parties, and resilience testing. The taxonomies differ. The institution's underlying inventory is the same.
Incident reporting is the fourth area. DORA Article 19 requires reporting of major ICT-related incidents to the competent authority within tight initial, intermediate and final deadlines, using a harmonised template. NIS2 imposes a twenty-four-hour early warning, a seventy-two-hour incident notification and a one-month final report. The Securities and Exchange Commission Rule 10b-5 cybersecurity disclosure rules impose materiality-triggered disclosure within four business days. A single incident-classification engine, calibrated against all three thresholds, can produce the required reports from a single source of truth.
Governance arrangements complete the convergence. DORA requires the management body to approve the ICT risk framework, allocate clear roles and responsibilities, and ensure adequate budget. NIS2 Article 20 imposes personal accountability on management bodies for cybersecurity risk management, with training obligations. FFIEC examiner expectations on board oversight align. The institution that documents board-level approval, named accountable executives, training and challenge once, can evidence each regime from that documentation.
The practical implementation is a single resilience scoring model that takes the institution's control inventory as input and produces, for each control, a score against each regime's specific articulation, plus an aggregated residual-risk view at the business-service level. The model is owned by the chief information security officer or chief operational resilience officer, validated under SR 11-7 equivalent standards, and reported to the board on a quarterly cadence. The output is a single dashboard that shows DORA, NIS2 and FFIEC CAT positions side by side, with the gap to each regime expressed in remediation cost and time.
The benefit is not only audit-cost reduction. The benefit is genuine visibility. When the same control is scored against three regimes, the gaps that appear are real. A control that is adequate for FFIEC and inadequate for DORA is a control that the institution actually needs to remediate. A control that is adequate for all three is a control the institution can stop investing in. The parallel-programme model conceals both findings.
The board-level question is whether the institution runs one operational resilience programme or three. Where the answer is three, the cost of compliance is two to three times higher than it needs to be, the residual-risk view is fragmented, and the response to a cross-border incident will be slower than the response of an institution that has unified its scoring model. The remediation is not technical. It is organisational.
Cabier Consulting's 2026 brief, Governance Above the Rail, includes a unified resilience scoring template that maps the three regimes to a single control inventory. The institutions that have adopted the template are evidencing each regime from one source of truth and have reduced their audit preparation cost by between thirty and fifty percent. The institutions that have not, are managing three workbooks.
Operational resilience is the area in which institutional governance has the most to gain from synthesis and the most to lose from inertia. The regimes are not going to converge formally. The institution that synthesises them internally captures the convergence anyway.
Convergence is also visible in third-line of defence expectations. Internal audit functions in institutions subject to two or more of the regimes are now organising their audit universe around control objectives rather than regulatory regimes. A control objective such as identity and access management for critical systems is tested once, with the evidence mapped to the DORA, NIS2 and FFIEC articulations. The audit committee receives a single residual-risk view by control objective, with regime-specific overlays where required.
The supervisor-college pattern is reinforcing the unified-model approach. The European Supervisory Authorities oversight forum for critical ICT third-party service providers under DORA, the national competent authority forums under NIS2, and the cross-border supervisory colleges for large international banks are increasingly sharing findings and cross-referring observations. An institution that presents inconsistent control narratives across regimes will see those inconsistencies surface in the next supervisory dialogue.
Vendor-level convergence is the parallel trend. Major cloud service providers, managed security service providers and ICT outsourcers now publish unified compliance attestations that map their controls to DORA, NIS2, FFIEC and ISO/IEC 27001. Institutions that align their internal scoring model to those vendor attestations reduce the cost of third-party assurance and accelerate exit testing. Vendors that do not publish unified attestations are increasingly disqualified from procurement processes for critical or important functions.
Scenario library design is the operational core of the unified model. Scenarios should be defined by impact, not by cause. A loss of access to a critical core banking platform for four hours has the same business-service consequences whether the cause is a ransomware attack, a regional cloud outage or a misconfigured deployment. The institution that runs scenarios at the impact level can satisfy DORA Article 25, NIS2 business-continuity testing and FFIEC Cyber Resilience Review expectations from a single library, with cause-specific overlays for the threat-led testing required for significant DORA institutions.
Recovery time and recovery point objectives align across the regimes. Impact tolerances under PRA SS1/21 are expressed in time. DORA critical or important function recovery objectives are expressed in time. FFIEC recovery time and point objectives are expressed in time. A single set of business-service-level objectives, set by the board and tested in the unified scenario library, satisfies the time-based dimensions of each regime.
Crisis communication is the final test of the unified model. A cross-border incident that simultaneously triggers DORA Article 19 reporting, NIS2 Article 23 reporting and SEC Rule 10b-5 disclosure requires the institution to communicate consistent facts to multiple supervisors and to the market within tight windows. A unified incident playbook, owned by the chief operational resilience officer, with pre-agreed decision rights and pre-drafted templates, is the only structure that has been shown to perform under live conditions.
Board reporting is the supervisor's preferred entry point. The most efficient board pack for operational resilience presents one residual-risk view by important business service, with overlays showing the regime-specific positions, the open remediation items, the third-party concentration and the recent test results. A board that receives three separate packs from three separate workstreams cannot challenge effectively and cannot set a coherent appetite. Unified reporting is not a presentational improvement. It is a governance instrument.
Training and competency requirements are explicit under NIS2 Article 20, implicit under DORA and FFIEC, and consistent across all three. Management bodies must follow specific training to gain sufficient knowledge and skills to apprehend and assess cybersecurity risks and management practices. Institutions that document a single annual training programme covering the regimes satisfy the requirement once. Institutions that run regime-specific training repeat the same material at greater cost and with lower retention.
Procurement is the operational expression of third-party risk. A procurement function that has integrated the DORA contractual clauses, NIS2 supply-chain expectations and FFIEC outsourcing guidance into a single template and a single onboarding workflow processes vendors faster, evidences compliance better and reduces the cost of remediation when a vendor's posture changes. Procurement teams operating from regime-specific templates create inconsistencies that surface in the next thematic review.
Insurance underwriting of cyber and operational risks has begun to differentiate between institutions that operate a unified resilience model and those that do not. Underwriters reviewing a single residual-risk view alongside test evidence and third-line attestations price risk lower than underwriters working from fragmented documentation. The premium differential is now material at the enterprise level and is expected to widen as loss experience from the unified-model adopters accumulates.
Recovery exercises that simultaneously test technical recovery, business-service recovery and crisis-communication recovery are the closest available proxy for actual incident performance. Institutions should run at least one full-scope exercise per annum, with regulator observation where the supervisory dialogue supports it. The exercise findings should feed the unified scoring model and the board pack in the next cycle.
Board questions to ask now.
Has the management body received, within the last twelve months, an independent report on the control plane that addresses this asset class or capability, with named accountable executives, residual risks and a remediation timetable? Has the institution validated that its evidence file would survive a supervisor's read-through without external assistance? Has the third line of defence, internal audit, performed independent testing of the controls at the granularity the regime requires?
Operating model implications.
The capability described above is an institutional layer, not a vendor product. It must be owned by a named function, resourced at a level proportionate to the institution's exposure, and integrated with the first and second lines of defence under clear escalation paths. Where the function is matrixed across business lines, an accountable executive in the second line must hold the consolidated view.
Twelve-month implementation plan.
In the first quarter, complete the inventory of in-scope positions, processes or models, and confirm coverage against the applicable regime. In the second quarter, close the data-integration gaps and stand up the evidence file. In the third quarter, perform an independent third-line review and remediate the priority findings. In the fourth quarter, present the resulting residual-risk view to the board, set the impact tolerances and the risk appetite, and publish the operating standard for ongoing oversight.
Cabier Consulting's 2026 institutional brief, Governance Above the Rail, sets the architectural context within which the obligations discussed here are best understood. Reciprocal reading at https://cabierconsulting.com/insights/governance-above-the-rail-2026 is recommended for institutions building their control plane.