Cybersecurity and IT governance: 20 priorities for businesses in 2026-2027

NIS2, DORA, AI Act, Cyber Resilience Act, ISO 27001, COBIT, ITIL: how to anticipate new requirements and turn compliance into a performance lever?

OPNEO Insights — IT Governance & Cybersecurity

13 October 2026 | Reading time: 12 minutes

Introduction: a profound transformation of IT governance

Cybersecurity and IT governance are undergoing a major transformation in Europe.

The gradual implementation of new European regulations, notably NIS2, DORA, the AI Act and the Cyber Resilience Act, strengthens the requirements placed on businesses regarding security, risk management and digital resilience.

At the same time, international frameworks such as ISO 27001, ISO 42001, ISO 20000-1, COBIT and ITIL continue to evolve to meet increasingly complex IT environments.

For general management and IT departments, these developments raise several fundamental questions:

• Which regulations actually concern our business?
• Which standards should we adopt and which are optional?
• How to effectively structure IT governance?
• Which risks should be prioritised?
• How to improve security without unnecessarily multiplying costs, procedures and tools?

The issue is no longer simply to protect IT systems. It is about sustainably managing digital risks while ensuring the performance of the business.

In this article, OPNEO presents the main regulatory and normative developments, identifies 20 points of attention for 2026-2027, including 5 strategic priorities, and proposes a concrete method to transform them into an action plan.

1. Understand regulations, standards and frameworks

Before embarking on a compliance approach, it is essential to distinguish three categories of texts.

Mandatory regulations

European regulations and national laws create legal obligations for companies falling within their scope.

These include:

• NIS2 : strengthening the cybersecurity of essential and important entities.
• DORA : digital operational resilience of the financial sector.
• AI Act : regulation of artificial intelligence systems.
• Cyber Resilience Act (CRA) : cybersecurity requirements applicable to products containing digital elements.
• GDPR : protection of personal data.
• eIDAS 2.0 : digital identity and electronic trust services.

Their requirements depend notably on the sector of activity, the size of the organisation, its economic role, and the nature of the services or products offered.

A SME is therefore not automatically subject to all these regulations.

International standards

ISO and IEC standards provide management systems or practices that allow for the structuring of an organisation's activities.

Among the main standards:

Standard	Domain
ISO/IEC 27001:2022	Information security management
ISO/IEC 27002:2022	Information security controls
ISO/IEC 27005:2022	Information security risk management
ISO/IEC 27701	Privacy management
ISO 22301:2019	Business continuity
ISO/IEC 42001:2023	Artificial intelligence management
ISO/IEC 20000-1:2018	IT service management
ISO/IEC 27036	Security of supplier relationships
ISO/IEC 27034	Application security
ISO 19011:2018	Guidelines for auditing management systems

These standards are generally voluntary, except when a regulation or contractual obligation imposes certain requirements.

A company can implement ISO 27001 without necessarily seeking certification.

The ISO/IEC 27001:2022 standard is notably a recognised framework for establishing, maintaining, and improving an information security management system (ISMS). ISO

The governance and best practice frameworks

Other frameworks allow for the organisation and management of information systems.

COBIT 2019 provides a governance and management framework for information technology.

ITIL 4 provides practices for managing IT services.

EBIOS Risk Manager, developed under the auspices of ANSSI, provides a method for assessing and managing digital risks.

SecNumCloud is a French framework for qualifying cloud service providers that meet high security requirements.

ReCyF, developed by ANSSI, supports preparation for the cybersecurity requirements related to NIS2 in France.

These approaches are not competitive.

They can be combined to build an overall IT governance that is proportionate to the needs of the business.

2. The five strategic priorities for 2026-2027

Among the twenty topics analysed, five deserve particular attention from general management and CIOs.

Priority 1 — Anticipate NIS2 and structure risk governance

The European NIS2 directive represents an important evolution of the European cybersecurity framework.

It aims in particular to strengthen the management of digital risks in sectors essential to the economic and social functioning of the European Union.

It introduces requirements regarding:

• The management of cybersecurity risks.
• The security of networks and systems.
• The management and notification of incidents.
• Business continuity.
• The security of suppliers.
• The responsibility of management bodies.

In France, companies must follow the national transposition of NIS2 and the implementation methods specified by the competent authorities.

The European deadline for transposition was set for 17 October 2024. This deadline should not be confused with the timetable for the application of national measures.

The point of attention

For potentially affected companies, the first step is to determine their regulatory scope.

It is necessary to identify in particular:

1. The activities and services potentially falling within the scope of NIS2.
2. The associated information systems.
3. The risks that could compromise these activities.
4. The existing security measures.
5. The gaps between the current situation and the applicable requirements.

The recommended action

Conduct a NIS2 applicability assessment and an initial cybersecurity maturity analysis.

This approach is of interest even for companies that may ultimately not be directly subject to the directive.

Indeed, the contracting authorities subject to NIS2 can strengthen their contractual requirements towards their service providers.

Priority 2 — Establish a ISMS based on ISO 27001

ISO 27001 is one of the main international standards for information security management.

Its relevance goes far beyond technical aspects.

The standard proposes a structured organisation around several principles:

• Understand the context of the business.
• Identify the stakeholders and their requirements.
• Define a security scope.
• Assess the risks.
• Determine the necessary measures.
• Measure their effectiveness.
• Organise continuous improvement.

The ISO/IEC 27001:2022 version remains a central reference for structuring ISMS.ISO

The point of attention

Many companies already have security measures in place, but struggle to demonstrate their coherence and effectiveness.

Technical measures sometimes exist without proper risk management.

These include:

• Backups without regular restoration tests.
• Unformalised security rules.
• Access rights without periodic reviews.
• Suppliers without risk assessment.
• Security decisions without traceability.

The recommended action

Gradually structure an ISMS based on ISO 27001, without considering certification as a systematically necessary objective.

The priority must be the effective reduction of risks and the improvement of governance.

Priority 3 — Framing artificial intelligence with the AI Act and ISO 42001

Artificial intelligence is now integrated into many business processes.

It is particularly involved in :

• Content production.
• Software development.
• Document analysis.
• Human resources.
• Customer service.
• Knowledge management.
• Process automation.
• Decision support.

However, its adoption introduces new risks.

Companies must particularly consider data privacy, model errors, biases, traceability, and technological dependencies.

A new regulatory framework

The European AI Act introduces differentiated obligations based on risks and the roles of the stakeholders involved.

As of 2 August 2026, a significant part of the regulation is applicable, particularly certain transparency requirements.

The timeline has also been adjusted by the European simplification measures that came into effect in July 2026: certain obligations related to high-risk systems are scheduled for December 2027 or August 2028, depending on the categories.Digital Strategy

The role of ISO 42001

The ISO/IEC 42001:2023 standard proposes a management system specifically dedicated to artificial intelligence.

It allows for the organisation of risk management and the responsible use of AI systems.ISO

The point of attention

A company can today use several dozen applications integrating artificial intelligence without having a consolidated view of its uses.

This situation poses a governance risk.

The recommended action

Establish a register of AI uses and define an appropriate governance policy.

It is particularly important to document :

• The tools used.
• The business leaders.
• The data processed.
• The relevant suppliers.
• The identified risks.
• The necessary validations.

Priority 4 — Mastering suppliers, the cloud and the digital supply chain

Companies' dependence on technology suppliers continues to grow.

Information systems now largely rely on :

• Cloud suppliers.
• SaaS publishers.
• Managed service providers.
• Security service providers.
• Integrators.
• Specialised providers.

A failure at a supplier can cause a service interruption, data loss or a security incident.

NIS2 and DORA thus pay particular attention to managing risks related to providers.

The point of attention

Many companies know their suppliers, but do not necessarily have a mapping of their critical dependencies.

Several questions need to be asked :

What would happen if our main cloud provider became unavailable for several days?

Could we quickly recover our data?

Do we know the subcontractors involved in processing our information?

Do the contractual commitments really cover our continuity needs?

The recommended action

Establish a register of critical suppliers and assess their risks.

This approach must integrate contractual commitments, recovery capabilities, data security, and reversibility options.

Priority 5 — Develop a true operational resilience capability

Cybersecurity cannot guarantee the absence of incidents.

Companies must therefore prepare to operate despite a major IT failure.

This approach is at the heart of operational resilience requirements.

It particularly concerns:

• Business continuity.
• IT recovery.
• Incident management.
• Crisis management.
• Communication.
• Testing and exercises.

The ISO 22301 standard is a recognised framework for structuring business continuity management.

The point of attention

A successful backup does not guarantee the ability to resume a business activity.

There is a significant difference between restoring a server and reinstating a service essential to the business.

The recommended action

Conduct a business impact analysis (BIA), formalise recovery objectives, and organise regular testing.

The company must particularly determine:

• How long can each critical activity be interrupted.
• What data loss can be tolerated.
• What means are necessary to resume.
• Who decides in a crisis situation.
• How customers and collaborators are informed.

Resilience must be measured, tested, and improved.

3. The fifteen other points of attention to integrate into the IT roadmap

The previous five priorities form a strategic foundation.

Fifteen other topics must also be integrated into IT governance.

6. Protection of personal data: GDPR and ISO 27701

The GDPR has imposed obligations regarding the processing of personal data since 2018.

Companies must continue to strengthen:

• Control of purposes and legal bases.
• Data protection by design.
• Management of retention periods.
• Securing processing.
• Management of data breaches.
• Relationships with subcontractors.

The ISO 27701 standard can help structure a privacy management system.

Point of attention: check that GDPR compliance is integrated into IT and business processes, and does not rely solely on legal documentation.

7. Identity and access management

The compromise of credentials poses a major risk to organisations.

Recommended practices include:

• Multi-factor authentication.
• Account lifecycle management.
• Privilege limitation.
• Separation of responsibilities.
• Periodic rights reviews.
• Securing administrator accounts.

Point of attention : automate, where relevant, the processes for granting and revoking access.

8. Mapping and inventory of IT assets

An organisation cannot properly manage what it does not know.

The asset inventory must cover applications, infrastructure, equipment, cloud services, data, and critical dependencies.

Point of attention : have an up-to-date mapping of the information system and identify the owners of each important asset.

9. Vulnerability and patch management

Companies must organise regular monitoring of vulnerabilities affecting their systems.

This approach includes :

• Identifying exposed components.
• Security monitoring.
• Vulnerability assessment.
• Patch prioritisation.
• Tracking remediations.

Point of attention : prioritise based on actual exposure and business importance rather than solely on technical scores.

10. Cyber Resilience Act : security of software and digital products

The Cyber Resilience Act introduces cybersecurity obligations for many products containing digital elements, including software.

Two deadlines are particularly important :

11 September 2026 : implementation of the reporting obligations for certain actively exploited vulnerabilities and certain serious incidents.

11 December 2027 : general application of the main requirements of the regulation.

For the manufacturers concerned, the CRA strengthens expectations regarding security by design, vulnerability management, and product maintenance. European Commission

Point of attention : companies that market software or digital products must assess their position in the CRA responsibility chain.

11. Incident management and notification

European regulations provide for different incident reporting mechanisms.

The obligations vary according to the applicable text, the severity of the incident, and the nature of the data or services involved.

It becomes essential to have documented procedures allowing for :

• Detection.
• Qualification.
• Escalation.
• Response.
• Notification.
• Post-incident analysis.

Point of attention : anticipate reporting obligations before an incident occurs.

12. DORA : digital resilience of the financial sector

Applicable from 17 January 2025, the DORA regulation strengthens the requirements for digital operational resilience of the relevant financial entities.

It notably organises:

• The management of ICT risks.
• The management and reporting of incidents.
• Resilience testing.
• The supervision of supplier risks.
• The oversight of critical ICT service providers.

DORA mainly concerns financial actors falling within its scope, but it can also have contractual implications for their suppliers.

Point of attention: ICT service providers working with financial actors must anticipate enhanced security and resilience requirements.

13. Software Development Security and DevSecOps

Security must be integrated throughout the application development lifecycle.

The relevant practices include:

• Code reviews.
• Dependency analysis.
• Security testing.
• Secret protection.
• CI/CD pipeline security.
• Software component management.

Point of attention: integrate automated security controls into development processes.

14. Logging, Detection and Supervision

The detection capability is an important factor in reducing the impact of incidents.

Organisations must identify significant events, centralise relevant logs, and define alert modalities.

Point of attention : adapt supervision to business risks and the actual capacity for processing alerts.

15. Encryption and protection of sensitive information

The protection of sensitive information relies notably on appropriate encryption devices.

It concerns stored data, network exchanges, backups, and technical secrets.

Point of attention : document encryption rules and manage the lifecycle of cryptographic keys.

16. IT service management: ITIL and ISO 20000-1

Good security does not, by itself, guarantee the quality of IT services.

Companies must also manage :

• Operational incidents.
• Service requests.
• Changes.
• Recurring problems.
• Service levels.
• Availability.
• Operating costs.

ITIL 4 provides practices for organising service management.

ISO/IEC 20000-1:2018 defines the requirements for a service management system. This edition, confirmed in 2023, remains current.ISO

Point of attention : implement processes proportionate to the size and complexity of the organisation.

17. Global governance of IS: COBIT

COBIT allows for addressing the information system from the perspective of corporate governance.

It notably contributes to structuring :

• Strategic alignment.
• Value creation.
• Resource management.
• Risk management.
• Performance measurement.
• Clarification of responsibilities.

Point of attention : linking IT decisions to the economic and operational objectives of the company.

18. Digital identity and trust services : eIDAS 2.0

The European eIDAS framework has evolved to support the development of European digital identity and trust services.

These developments may influence identification, authentication, and electronic signature practices.

Point of attention : assess the implications of eIDAS 2.0 when the company's activities depend on regulated digital identity mechanisms or trust services.

19. Digital sovereignty, cloud and reversibility

Technological dependencies raise increasing questions of data control and continuity.

Companies must particularly consider :

• Data location.
• International transfers.
• Contractual risks.
• Supplier dependencies.
• Reversibility.
• Security requirements applicable to cloud services.

The French framework SecNumCloud can be particularly relevant for certain high security needs.

Point of attention : assess digital sovereignty in relation to the real risks of the business, without reducing it to the mere geographical location of servers.

20. Audit, indicators and continuous improvement

Effective governance relies on the ability to measure and demonstrate results.

Organisations must have appropriate indicators and organise regular reviews.

These mechanisms allow in particular :

• To verify the implementation of measures.
• To assess their effectiveness.
• To identify gaps.
• To track action plans.
• To document decisions.

Point of attention : build a continuous improvement approach based on verifiable elements rather than solely on document production.

4. Summary : the 20 points of attention to follow

The following table provides indicative prioritisation for an SME or a mid-sized company wishing to structure its IT governance.

No.	Point of attention	Main reference	Priority
1	Applicability of NIS2 and risk governance	NIS2 / ANSSI	P1
2	Information security management	ISO 27001 / 27005	P1
3	Governance of artificial intelligence	AI Act / ISO 42001	P1
4	Supplier and cloud risks	NIS2 / ISO 27036	P1
5	Business continuity and resilience	ISO 22301	P1
6	Personal data protection	GDPR / ISO 27701	P2
7	Identity and access management	ISO 27002	P2
8	Mapping of IT assets	ISO 27001	P2
9	Vulnerability management	ISO 27002	P2
10	Digital product security	Cyber Resilience Act	P2
11	Incident management and reporting	NIS2 / DORA / GDPR	P2
12	Financial operational resilience	DORA	P2*
13	Software development security	ISO 27034	P2
14	Logging and monitoring	ISO 27002	P2
15	Encryption and secret protection	ISO 27002	P2
16	IT service management	ITIL / ISO 20000-1	P3
17	Governance and performance of the IS	COBIT	P3
18	Digital identity and trust	eIDAS 2.0	P3*
19	Sovereignty and reversibility	GDPR / SecNumCloud	P3
20	Audit and continuous improvement	ISO 27001 / ISO 19011	P2

Reading of priorities :

• P1 : strategic priorities to be engaged quickly.
• P2 : important projects to be integrated into the roadmap.
• P3 : topics to be planned according to issues and maturity.
• P2/P3 :** priorities likely to become immediate depending on the sector and applicable obligations.

This ranking is not a regulatory hierarchy. An applicable legal obligation that has already come into force must be addressed according to its deadline, regardless of this indicative prioritisation.

5. How to effectively organise IT governance ?

In the face of this diversity of standards, a question naturally arises :

Should a single framework be chosen to manage the entire information system ?

Our analysis is that a combined approach is generally more relevant.

ISO 27001 is an excellent entry point for developing a risk management culture.

However, this standard does not cover all aspects of IT management on its own.

Financial management, architecture, digital transformation, skills management or project portfolio management require complementary methods.

An integrated approach around three frameworks

Dimension	Framework	Purpose
Strategic governance	COBIT	Aligning the IS with the company's objectives
Security management	ISO 27001	Structure risk management and security
Operational management	ITIL / ISO 20000-1	Improve the quality and efficiency of IT services

This framework addresses three essential questions.

COBIT: are we making the right IT choices?

ISO 27001: are we managing the associated risks?

ITIL: are we effectively utilising IT services?

It is not about establishing a formal hierarchy between these frameworks, but about using their complementarities.

The goal is to build a coherent organisation capable of linking strategy, security, and operations.

6. A pragmatic 90-day roadmap

It would be unrealistic for an SME or a mid-sized company to simultaneously launch twenty transformation programmes.

A gradual approach allows for focusing efforts on topics that present the best balance between risk reduction, business value, and resources committed.

Days 1 to 30: understand and assess

The first step is to establish an objective vision of the information system.

Priority actions:

• Identify the main business activities.
• Map critical IT services.
• Assess regulatory obligations.
• Conduct an initial risk analysis.
• Identify strategic suppliers.
• Assess the maturity of IT processes.

Expected deliverable: a synthetic diagnosis including the main risks, gaps, and initial recommendations.

Days 31 to 60: define the priorities

The results of the diagnosis allow for the construction of a roadmap.

Priority actions:

• Classify the risks according to their business impact.
• Define the treatment measures.
• Identify the urgent actions.
• Evaluate the necessary resources.
• Designate the responsible parties.
• Define the monitoring indicators.

Expected deliverable: a prioritised, budgeted action plan approved by management.

Days 61 to 90: establish governance

The third step involves initiating the first actions and structuring their governance.

Priority actions:

• Start the risk reduction measures.
• Formalise the main responsibilities.
• Organise governance reviews.
• Implement performance indicators.
• Schedule audits and controls.
• Organise the first continuity exercises.

Expected deliverable: an operational governance framework and a continuous improvement roadmap.

Why a 90-day approach?

The goal is not to guarantee full compliance in three months.

It is about moving from a sometimes fragmented situation to an organised governance, with clear responsibilities and shared priorities.

This approach must then be sustained over time.

7. How OPNEO supports companies in these transformations

In the face of the multiplication of regulations, standards and frameworks, companies are confronted with a major difficulty: how to transform complex requirements into concrete, proportionate and value-creating actions?

The answer does not necessarily involve multiplying cybersecurity tools, recruiting new teams or immediately engaging in a certification process.

It begins with an understanding of business issues, an objective assessment of risks and the definition of a roadmap tailored to the organisation's resources.

OPNEO supports the leaders of SMEs and mid-sized companies in the governance, securing and transformation of their information system, from strategic reflection to operational management.

A pragmatic approach, from strategy to execution

Our support is structured around five complementary axes.

1. Diagnosis and maturity assessment

Before making investments, it is essential to understand the existing situation.

OPNEO intervenes to:

• Analyse the organisation and governance of the information system.
• Identify the main IT risks.
• Assess cybersecurity practices.
• Examine relevant regulatory and normative requirements.
• Identify points of operational fragility.
• Build a roadmap for improvement.

The objective: to provide leaders with a clear vision of their risks, priorities and necessary investments.

2. Governance and management of the information system

An effective IT management must directly contribute to the company's objectives.

OPNEO supports organisations to:

• Structure IT governance.
• Clarify responsibilities.
• Define decision-making processes.
• Establish performance indicators.
• Organise supplier management.
• Align IT investments with business priorities.

This approach can notably rely on the principles of COBIT, ITIL, and ISO 20000-1.

The objective: to transform IT into a controlled, measurable, and value-creating function.

3. Cybersecurity, risk management, and compliance

Cybersecurity requirements must not be addressed independently of the company's strategy.

OPNEO supports the structuring of security initiatives, particularly around:

• Risk analysis and treatment.
• The establishment of an ISMS based on ISO 27001.
• Preparation for NIS2 requirements.
• Governance of artificial intelligence usage.
• Management of supplier risks.
• Business continuity and operational resilience.
• Preparation for audits and certification processes.

When topics require legal expertise, an independent audit, or certification, OPNEO can assist in coordinating specialised stakeholders.

The objective: to sustainably integrate security into the company's management practices, rather than limiting it to a documentary approach.

4. Transformation and operational improvement

Identifying risks and defining a strategy is a first step.

However, it is also necessary to transform decisions into results.

OPNEO can intervene in the management of improvement programmes:

• Securing infrastructures and cloud services.
• Modernising information systems.
• Identity and access management.
• Improving IT processes.
• Organising business continuity.
• Managing providers and integrators.
• Deploying new digital tools and services.

The intervention can combine direct project management and coordination of specialised expertise.

The objective: to achieve measurable operational results while controlling costs, deadlines, and risks.

5. Outsourced or shared IT management

Not all companies need, or have the means, to have a full-time permanent CIO.

However, they must be able to make structuring decisions regarding their information systems.

OPNEO offers support in outsourced or shared IT management, allowing them to benefit from a management capacity tailored to the company's needs.

This arrangement may include:

• Defining the IT strategy.
• The construction and monitoring of the IT budget.
• Risk governance.
• Management of suppliers.
• Steering of strategic projects.
• Participation in management committees.
• Monitoring of performance and service commitments.

The intervention can be occasional, organised around a transformation programme or part of regular collaboration.

The objective: to provide a genuine IT management capability, without imposing the structure and costs of a full-time permanent function.

Our belief: compliance must serve performance.

A well-conducted governance and cybersecurity approach is not limited to reducing the likelihood of an incident.

It must also contribute to:

• Ensuring the daily operation of the business.
• Clarify responsibilities.
• Improving the quality of IT services.
• Reducing financial and operational risks.
• Optimising digital investments.
• Strengthening the trust of clients and partners.
• Supporting the growth and transformations of the organisation.

At OPNEO, we prioritise an approach based on three principles.

Proportionality: adapting measures to the challenges and resources of each organisation.

Pragmatism: seeking concrete results rather than multiplying procedures without added value.

Continuous improvement: install sustainable steering, evaluation and adaptation mechanisms.

Compliance is important. But it must remain in service of a broader objective: a reliable, secure, high-performing information system capable of supporting the ambitions of the business.

8. Conclusion: from compliance to performance

The new European requirements should not be approached solely as an accumulation of regulatory constraints.

They also represent an opportunity to professionalise IT management, reduce operational risks, and strengthen the trust of clients and partners.

For an SME or a mid-sized enterprise, this evolution can become a true lever for transformation.

Establishing structured governance allows for a better understanding of technological dependencies, clarifying responsibilities, ensuring reliable services, and making more relevant investment decisions.

Regulations such as NIS2, DORA, the AI Act, and the Cyber Resilience Act strengthen security and resilience requirements for the organisations concerned.

Frameworks like ISO 27001, ISO 42001, COBIT, or ITIL provide methods to organise practices and implement continuous improvement.

But the main issue is not to adopt the greatest number of standards or to multiply compliance projects.

It consists of determining:

• What risks truly threaten the activities of the business?
• What obligations must be met?
• What investments bring the greatest value?
• Which processes should be prioritised for improvement?
• How can the effectiveness of the measures taken be demonstrated sustainably?

The answer lies in IT governance capable of linking business issues, risks, technical means, and management decisions.

A shared responsibility between general management and the IT department

Cybersecurity and digital resilience can no longer be considered exclusively technical subjects.

They require organisational, financial, and strategic trade-offs.

The role of the IT department is therefore gradually evolving: beyond the operation of systems, it must contribute to risk management and the overall performance of the organisation.

This evolution also reinforces the need for regular dialogue between general management, business leaders, and IT teams.

The quality of IT governance is not measured by the number of procedures produced, but by its ability to inform decisions, manage risks, and support the company's objectives.

Anticipate rather than suffer

The years 2026 and 2027 represent an important period for European companies.

Regulatory developments are accelerating a transformation that is already underway: IT is becoming an increasingly decisive element of continuity, competitiveness, and the development of organisations.

Companies that anticipate these changes can reap sustainable benefits.

Those who wait to react to a regulatory obligation, a client requirement or an incident risk undergoing transformations that are more costly and harder to manage.

The real opportunity therefore lies in moving from a logic of compliance that is endured to a voluntary approach to governance, security and performance.

9. Let’s discuss your IT challenges

Does your company wish to anticipate new regulatory requirements, strengthen its cybersecurity or improve its IT governance?

Are you questioning the relevance of an ISO 27001 approach, preparation for NIS2, management of your suppliers or the organisation of your IT department?

OPNEO supports you in identifying your priorities, structuring your roadmap and managing its implementation.

Our interventions can take various forms: one-off diagnosis, consulting mission, transformation management or outsourced IT management on a shared basis.

Our ambition: to help you have a better-controlled, more resilient information system that is fully aligned with your business objectives.

Discover OPNEO and let’s discuss your projects →

Sources and references for further exploration

The following official resources allow for a deeper understanding of the main regulations and standards mentioned in this article.

Organisation	Resource	Link
ANSSI	NIS2 regulation and cybersecurity in France	cyber.gouv.fr
European Commission	Regulatory framework for artificial intelligence	AI Act
European Commission	Cyber Resilience Act	CRA
European Commission	DORA Regulation	European Commission — Finance
ISO	Information security management	ISO/IEC 27001
ISO	Artificial intelligence management	ISO/IEC 42001
ISO	IT service management	ISO/IEC 20000-1
ISACA	Governance of Information Systems	COBIT
PeopleCert	IT Service Management	ITIL
CNIL	Personal data protection	cnil.fr

This article presents an informative summary of the main issues of governance and cybersecurity. The obligations applicable to a company must be assessed according to its situation, its activity, and the regulations in force. The regulatory deadlines mentioned correspond to the information verified on 13 October 2026.