Regulatory Horizon Lab
The cyber rulebook is multiplying: DORA, NIS2, the SEC cyber rules, GDPR and a growing stack of US state laws — overlapping, each with its own scope, deadlines and penalties. Sit on the board’s risk committee and make each call the way a regulator and a court would judge it: decide what actually applies, fold the overlapping obligations onto one control set instead of five silos, prioritise by deadline and penalty, separate the duties the board must personally own from the operational ones, and pre-map a single incident to every reporting clock. Each decision shows you why.
Pair this drill with the free Cyber Regulatory Obligations Tracker — the document that records which regimes apply, their clocks, owners and board-reporting triggers. Educational drill, not legal advice; confirm applicability with counsel.
The real job. More noise, a tighter clock.
You chair the board’s risk committee facing a wall of new and overlapping cyber regulation — DORA, NIS2, the SEC rules, GDPR and US state laws. Work 10 board-room decisions — decide what applies, how to prioritise it, what the board must own and what to report — then see why each call is defensible. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on mapping the new wave of cyber regulation — EU DORA, EU NIS2, the US SEC cyber rules, GDPR and US state privacy/breach laws — to board-level obligations.
- You decide what actually applies (by sector, jurisdiction and whether you are a third-party provider to a regulated entity), how to prioritise it by deadline and penalty, and what the board must personally own.
- You practise the real traps: overlapping obligations that one control can satisfy, extraterritorial reach onto non-EU entities, one incident tripping GDPR’s 72 hours, NIS2’s ~24h/72h flow and the SEC’s four-business-day clock at once, and why NIST alignment is not the same as compliance.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal advice. Pair it with the free Cyber Regulatory Obligations Tracker template.
Frequently asked questions
What is the Regulatory Horizon Lab?
A free, in-browser decision simulation that puts you in the board’s risk committee facing overlapping cyber regulations — EU DORA, EU NIS2, the US SEC cyber disclosure rules, GDPR and US state privacy and breach-notification laws. You work through board-room decisions — which regimes apply, how to prioritise them, which obligations the board must own, and how one incident triggers several reporting clocks — and each has a single board-defensible answer, revealed after you lock in your call.
Which regulations does it cover?
EU DORA (Digital Operational Resilience Act, in application since January 2025, for EU financial entities and their critical ICT third-party providers), the EU NIS2 Directive (expanded sector scope, management-body accountability, staged incident reporting), the US SEC rules (Form 8-K Item 1.05 incident disclosure and Regulation S-K Item 106 governance disclosure), the GDPR (including its 72-hour breach notification), and US state privacy laws (e.g. California CCPA/CPRA) and state breach-notification laws.
Is this legal advice?
No. The lab is an educational drill and the regulatory references are summarised for orientation and can change. Applicability turns on your specific sector, jurisdiction, corporate footprint and data — always confirm the current requirements and whether a regime applies to you with qualified counsel.
Who is it for?
Board directors, CISOs, general counsel, compliance and risk leaders, and anyone who has to tell a board which cyber regulations apply, what they oblige, and in what order to act — and who wants to rehearse those calls before a deadline or an incident makes them real.