--- title: "Compliance: NIS2, DORA and GDPR with Offline | Firevault" url: https://fire-vault.com/compliance description: "Explore relevant regulations, standards and security frameworks by industry. Understand the requirements and how Offline Secure Storage and Control can…" lang: en-GB --- # Understand the rules. Control the exposure. The requirements are different for every organisation. The fundamentals are not. Understand the frameworks that matter, then see where physically disconnected storage and deliberately controlled connectivity can contribute. Explore by industryView the frameworks One place for the requirement, the technical response and the evidence. Why it matters ## A framework tells you what to achieve. Not always how. Compliance requirements are written around outcomes: protect information, limit exposure, govern access and prepare for disruption. But the technical choices are yours. The important question is where your existing architecture leaves something continuously reachable, and which controls can change that. **Understand** What the framework expects and which organisations it concerns. **Align** See where Offline Secure Storage®, Control or both provide relevant technical measures. **Evidence** Identify what an organisation still needs to implement, document and test. Find your industry ## Your industry changes the requirements. Start with the environment you operate in. We bring the relevant frameworks forward, then show their requirements alongside Firevault’s technical contribution. ### Select your industry ### Then your country or region Explore the full framework library, then select the area most relevant to your organisation. 47 frameworks brought forward in the explorer below. International standards appear for every country. National and regional rules appear only for the country or region you choose. Industry and country selection indicate potential relevance, not a determination that a particular regulation applies. Rules from one jurisdiction can also reach organisations elsewhere, for example when they provide services into the EU. Organisational activity and legal scope must be assessed separately. The framework explorer ## The framework first. The technology second. Choose a regulation, standard or assessment framework. See what it means, who it concerns and the relevant contributions from both Firevault platforms. Explore frameworks United Kingdom European Union United States North America Australia Middle East Singapore Canada International Select any framework to see its detail without leaving this page. UK sector rule UK / financial services ### FCA operational resilience FCA operational resilience rules, SYSC 15A #### What is it? Firms identify important business services, set impact tolerances for severe but plausible disruption and show they can remain within them (SYSC 15A). #### Who does it concern? Firms within the scope of SYSC 15A, including banks, building societies, insurers, enhanced scope SM&CR firms, and payment and e-money institutions. Primary source Read the official framework (https://www.fca.org.uk/firms/operational-resilience) Technical alignment ## Two distinct capabilities. One clearer view. Offline Secure Storage® ### Protect the asset. Recovery copies for important business services held outside the connected estate, with retrieval tests as evidence. Physically disconnected storage and governed access. Explore OSS (https://fire-vault.com/offline-secure-storage) Control by Firevault ### Control the path. No Control mapping is published for FCA operational resilience. Its requirements centre on the information you hold, so the contribution shown is Offline Secure Storage®. Physical connectivity boundaries and authorised, just-in-time intervention. Explore Control (https://fire-vault.com/control) Requirements in practice ## See the requirement. Then the contribution. Open any requirement to see the technical measure each product can contribute, its limits and where to find the official text. The Both, OSS and Control filter above applies here too. **FCA operational resilience**2 requirements mapped SYSC 15A Remaining within impact tolerances _OSS_ #### OSS / protect the asset The data an important business service needs to recover is held on physically disconnected hardware, so a severe cyber scenario does not reach it. Testing Scenario testing and self-assessment _OSS_ #### OSS / protect the asset Retrieval tests with measured timelines give evidence for the self-assessment. **Offline Secure Storage®**Mapping important business services and setting tolerances remain the firm's responsibility. **Official references**FCA: Operational resilience (https://www.fca.org.uk/firms/operational-resilience) **Related on Firevault**OSS® for financial services (https://fire-vault.com/oss-for-financial-services) These describe possible technical contributions, not a certification, legal opinion or a claim that deployment alone satisfies an obligation. Neither product makes you compliant on its own. Board and director accountability ## The duty sits with the board. The evidence sits in the estate. Company law and regulators expect boards to be informed about cyber and resilience risk, to oversee it and to be able to show that they have. These duties do not prescribe technology. They ask what the board knew, what it asked for and what it reviewed. Choose a country to see its duties, the penalties regulators can impose, where personal liability can reach directors and senior managers, and enforcement already on the record. Choosing one in the selector above also updates this view. ### Director care Companies Act 2006, s.174(1) and (2) Directors must exercise reasonable care, skill and diligence, assessed against both their role and their actual knowledge and experience. This applies to directors of companies subject to the Act. **What the board can ask to see** Firevault can contribute access session records and retrieval test results for a board review of information risk. Companies Act 2006, s.174 (https://www.legislation.gov.uk/ukpga/2006/46/section/174) ### Company success Companies Act 2006, s.172(1) Directors must act in good faith to promote the company’s success for members as a whole, having regard to the listed factors including long-term consequences. This applies to directors of companies subject to the Act, with statutory qualifications. **What the board can ask to see** Firevault can contribute an offline classification schedule and retrieval test results to inform discussion of long-term information resilience. Companies Act 2006, s.172 (https://www.legislation.gov.uk/ukpga/2006/46/section/172) ### Material controls declaration UK Corporate Governance Code 2024, Provision 29 Boards should monitor and annually review the control framework and report on material control effectiveness, including a balance sheet date declaration for financial years beginning on or after 1 January 2026. This applies on a comply or explain basis to companies within the Code’s listing-rule scope. **What the board can ask to see** Firevault can contribute access session records, approvals and retrieval test results for the board’s assessment of relevant material controls. FRC, Provision 29 Mythbuster (https://www.frc.org.uk/docs/9097/html/) ### Cyber governance practice Cyber Governance Code of Practice, D1 and D2; E1 and E2, published 8 April 2025 Boards should seek assurance on incident recovery plans and annual exercises, establish cyber governance and require reporting at least quarterly. This voluntary guidance is intended for boards and directors of public and private organisations. **What the board can ask to see** Firevault can contribute retrieval test results and access approvals for periodic board assurance reporting. DSIT, Cyber Governance Code of Practice (https://www.gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice) ### What is at stake: United Kingdom For the organisation - **ICO fines under UK GDPR**Up to £17.5 million or 4% of worldwide turnover The higher maximum is £17.5 million or, for an undertaking, 4% of total annual worldwide turnover, whichever is higher. Security failures under Article 32 sit in the standard tier of £8.7 million or 2%, although a related breach of the data protection principles can reach the higher tier. UK GDPR Article 83; Data Protection Act 2018, s.157 · In force Data Protection Act 2018, s.157 (https://www.legislation.gov.uk/ukpga/2018/12/section/157) - **NIS Regulations penalties**Up to £17 million Operators of essential services and relevant digital service providers face three bands: up to £1 million for a non-material contravention, £8.5 million for a material contravention and £17 million where the contravention created, or could have created, a significant risk to service provision. Network and Information Systems Regulations 2018, reg.18(6) · In force NIS Regulations 2018, regulation 18 (https://www.legislation.gov.uk/uksi/2018/506/regulation/18) - **Cyber Security and Resilience Bill**Proposed: £17 million or 4% of worldwide turnover The Bill would replace the NIS penalty bands with a maximum of £17 million or 4% of worldwide turnover, whichever is higher, for more serious breaches and £10 million or 2% for less serious breaches. Enforcement would begin only after Royal Assent and secondary legislation. Cyber Security and Resilience (Network and Information Systems) Bill · Proposed, before Parliament on 8 November 2026 DSIT enforcement factsheet (https://www.gov.uk/government/publications/cyber-security-and-resilience-network-and-information-systems-bill-factsheets/enforcement) - **FCA and PRA penalties**No fixed statutory cap For an authorised firm that breaches a relevant requirement, including applicable operational resilience rules, the regulator may impose a penalty of such amount as it considers appropriate. Financial Services and Markets Act 2000, s.206(1) · In force FSMA 2000, s.206 (https://www.legislation.gov.uk/ukpga/2000/8/section/206) For directors and senior managers - **Director disqualification**Up to 15 years A director found unfit can be disqualified from acting as a director for between two and 15 years under section 6, and the Secretary of State can seek disqualification in the public interest under section 8. This is general company law, not an automatic sanction for a cyber incident. Company Directors Disqualification Act 1986, ss.6 and 8 · In force Company Directors Disqualification Act 1986, s.8 (https://www.legislation.gov.uk/ukpga/1986/46/section/8) - **Personal liability for data protection offences** Where a criminal offence under the Act is committed by a company with the consent or connivance of, or is attributable to neglect by, a director, manager or similar officer, that person is also guilty of the offence. It covers offences such as unlawfully obtaining or disclosing personal data, not the company's administrative fines. Data Protection Act 2018, s.198 · In force Data Protection Act 2018, s.198 (https://www.legislation.gov.uk/ukpga/2018/12/section/198) - **Claims for breach of the duty of care** A director who fails to exercise reasonable care, skill and diligence can be liable to the company, and members can bring a derivative claim on the company's behalf for negligence or breach of duty. Companies Act 2006, ss.174, 178 and 260 · In force Companies Act 2006, s.260 (https://www.legislation.gov.uk/ukpga/2006/46/section/260) - **Senior Managers Regime: Duty of Responsibility**Personal fines and prohibition In financial services, a senior manager can be fined personally where the firm breaches a requirement in their area and they did not take the steps reasonably expected to avoid or stop it. The regulator can also prohibit an individual from performing specified functions. Financial Services and Markets Act 2000, ss.56, 66, 66A and 66B · In force FSMA 2000, s.66A (https://www.legislation.gov.uk/ukpga/2000/8/section/66A) Enforcement on the record £20m #### British Airways ICO · October 2020 Penalty for security failures exposed by a 2018 cyber attack on its website and booking systems. ICO penalty notice (https://ico.org.uk/media2/migrated/2618421/ba-penalty-20201016.pdf) £14m #### Capita ICO · October 2025 Combined fines on Capita plc (£8 million) and Capita Pension Solutions (£6 million) for security failures linked to the March 2023 cyber attack. ICO announcement (https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/10/capita-fined-14m-for-data-breach-affecting-over-6m-people) £3.07m #### Advanced Computer Software ICO · March 2025 Fine after a 2022 ransomware attack, citing gaps in multi-factor authentication, vulnerability scanning and patch management. ICO announcement (https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/) £2.31m #### 23andMe ICO · June 2025 Fine for failing to implement appropriate security measures before a 2023 attack affecting 155,592 UK users. ICO enforcement record (https://ico.org.uk/action-weve-taken/enforcement/2025/06/23andme) A summary of selected duties, not legal advice. General director duties are not specific to cyber security, and how any duty applies depends on the organisation, its listing and its regulator. Firevault records can contribute evidence a board reviews. They do not discharge a director duty or make an organisation compliant. Penalty figures are statutory maxima or amounts announced by the regulator or court, not predictions. Whether any penalty or personal liability applies depends on the facts, the provision breached and national law. How it applies ## Translate the words into your environment. The same framework can mean very different implementation decisions for a hospital, a financial institution or an operational technology network. 01 ### Data that must stay protected Keep physically disconnected copies of selected critical information. Explore the approach (https://fire-vault.com/offline-secure-storage) 02 ### Access that should not always be connected Control selected standing network or supplier routes, connected just in time when authorised. Explore the approach (https://fire-vault.com/control) 03 ### A requirement to demonstrate Connect technical measures to responsibilities, testing and evidence. Explore the approach The distinction matters ## Control the path. Protect the asset. Control governs the physical network paths that exist and who may use them, connecting them just in time when authorised. Offline Secure Storage® protects selected information and recovery copies by keeping them physically disconnected when access is not needed. They solve different problems and may be used together. Evidence and responsibility ## Technology helps. Governance proves. No product makes an organisation compliant by itself. Policy, scope, implementation, operating procedures, testing and evidence remain essential. Firevault’s own certifications are separate from your obligations under the frameworks shown here. Firevault holds Cyber Essentials Plus; confirm current status, scope and validity with Firevault before relying on it. **Define** Identify the requirement, the responsible owner and the systems or information in scope. **Implement** Choose and document the relevant technical and organisational measures. **Demonstrate** Test operation, retain appropriate evidence and review changes over time. ### What your assessor receives For Offline Secure Storage®, the evidence pack contains: - **Access audit logs**Who opened which vault, when, from where and for how long. - **Encryption attestation**Encryption and key custody, stated in writing. - **Provisioning records**Identity verification completed before access. - **Classification schedule**What is held offline, by data class, and why. - **Retrieval tests**Evidence that recovery works, with measured timelines. - **Control statements**Wording per framework for your own submission. Guidance ## Briefings for your assessment. Plain-English guides to the standards assessors and insurers ask about most. - Guide**NCSC cloud backup principles**_What the NCSC asks of ransomware-resistant cloud backup, and where Firevault contributes._: https://fire-vault.com/learn/guides/ncsc-cloud-backup-compliance-guide - Briefing**Physical disconnection and UK GDPR**_How a physically disconnected copy supports security of processing._: https://fire-vault.com/compliance/uk-gdpr-physical-disconnection - Briefing**NIST SP 800-82r3 OT backup**_Backup and recovery expectations for operational technology._: https://fire-vault.com/compliance/nist-sp-800-82r3-ot-backup - Briefing**The 3-2-1-0 insurer standard**_What insurers increasingly expect from backup copies._: https://fire-vault.com/compliance/cyber-insurance-3-2-1-0 Your next step ## Which requirement is hardest to prove? Talk us through your framework, your infrastructure and the controls you need to demonstrate. We can discuss where offline storage and physical connection control are relevant. Speak to the team (https://fire-vault.com/contact) Book a mapping call: https://fire-vault.com/demo Get started ## Structured data ```json [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "@id": "https://fire-vault.com/compliance#breadcrumb", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com" }, { "@type": "ListItem", "position": 2, "name": "Compliance: NIS2, DORA and GDPR with Offline", "item": "https://fire-vault.com/compliance" } ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://fire-vault.com/#org", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com/", "identifier": "16320803", "sameAs": [ "https://www.linkedin.com/company/firevault-limited", "https://www.facebook.com/Firevaultltd/", "https://www.youtube.com/@Firevault-ltd" ] }, { "@type": "WebPage", "name": "Compliance: industry frameworks and technical alignment", "url": "https://fire-vault.com/compliance", "description": "Explore relevant regulations, standards and security frameworks by industry. Understand the requirements and how Offline Secure Storage and Control can contribute.", "publisher": { "@id": "https://fire-vault.com/#org" } }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://fire-vault.com/" }, { "@type": "ListItem", "position": 2, "name": "Compliance", "item": "https://fire-vault.com/compliance" } ] } ] }, { "@context": "https://schema.org", "@type": "WebPage", "@id": "https://fire-vault.com/compliance#webpage", "url": "https://fire-vault.com/compliance", "name": "Compliance: NIS2, DORA and GDPR with Offline", "description": "Explore relevant regulations, standards and security frameworks by industry. Understand the requirements and how Offline Secure Storage and Control can…", "isPartOf": { "@id": "https://fire-vault.com/#website" }, "about": { "@id": "https://fire-vault.com/#organization" }, "primaryImageOfPage": { "@type": "ImageObject", "url": "https://zomvctmqpgirvjnvawlz.supabase.co/storage/v1/object/public/brand-assets/seo/1775051324716-uusfyk.jpg" }, "inLanguage": "en-GB", "breadcrumb": { "@id": "https://fire-vault.com/compliance#breadcrumb" } }, { "@context": "https://schema.org", "@type": "Organization", "@id": "https://fire-vault.com/#organization", "name": "Firevault", "legalName": "Firevault Limited", "url": "https://fire-vault.com", "logo": { "@type": "ImageObject", "url": "https://fire-vault.com/logo.png", "width": 200, "height": 60 }, "foundingDate": "2025-03", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "address": { "@type": "PostalAddress", "addressCountry": "GB", "addressLocality": "United Kingdom" }, "contactPoint": [ { "@type": "ContactPoint", "contactType": "customer service", "email": "hello@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] }, { "@type": "ContactPoint", "contactType": "sales", "email": "sales@fire-vault.com", "availableLanguage": "English", "areaServed": [ "GB", "EU", "US", "AE" ] } ], "founder": [ { "@type": "Person", "name": "Mark Fermor", "jobTitle": "Founder, CTO and CMO" }, { "@type": "Person", "name": "David Bailey", "jobTitle": "Founder and CEO" } ], "areaServed": [ "United Kingdom", "Europe", "United States", "Middle East" ], "sameAs": [ "https://www.linkedin.com/company/firevault", "https://x.com/firevaultuk" ], "slogan": "Disconnect to Protect", "brand": [ { "@type": "Brand", "name": "Offline Secure Storage" }, { "@type": "Brand", "name": "Control by Firevault" }, { "@type": "Brand", "name": "Firebreak" } ], "knowsAbout": [ "Offline Secure Storage", "Physically disconnected data storage", "Physical Air Gap Data Protection", "Ransomware Protection", "Ransomware recovery", "3-2-1-1-0 backup rule", "AI kill switch", "Operational technology security", "Critical national infrastructure resilience", "Data Sovereignty", "GDPR Compliance", "NIS2 Compliance", "DORA Compliance", "NCSC Cyber Assessment Framework" ] }, { "@context": "https://schema.org", "@type": "WebSite", "@id": "https://fire-vault.com/#website", "name": "Firevault", "alternateName": [ "Firevault", "Firevault UK", "Firevault Limited" ], "url": "https://fire-vault.com", "publisher": { "@id": "https://fire-vault.com/#organization" }, "inLanguage": "en-GB", "description": "Firevault is a UK cyber resilience company. Data protection and storage through Offline Secure Storage. Network evolution and rapid protection through Control.", "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://fire-vault.com/learn?q={search_term_string}" }, "query-input": "required name=search_term_string" } } ] ```