Fix: OpenClaw in Docker — Connection Refused, Port Mapping, and Network Issues
Running OpenClaw in Docker and getting connection refused? Common issues with port mapping, bind addresses, DNS resolution, and WebSocket upgrades explained with fixes.
DevOps
CRA vs NIS2: Understanding the EU Cybersecurity Regulation Landscape
Luca Berton • • 2 min read
#cra#nis2#eu-regulation#cybersecurity#compliance
🔄 CRA vs NIS2: Two Sides of EU Cybersecurity
The CRA and NIS2 Directive are complementary but different. Organizations may be subject to both. Understanding where they overlap and where they diverge is essential.
Key Differences
| Aspect | CRA | NIS2 |
|---|---|---|
| Focus | Products with digital elements | Organizations and services |
| Who | Manufacturers, importers, distributors | Essential and important entities |
| What | Product security requirements | Organizational security measures |
| Enforcement | Market surveillance authorities | National cybersecurity authorities |
| Penalties | Up to €15M / 2.5% turnover | Up to €10M / 2% turnover |
| Timeline | Full enforcement Dec 2027 | Transposition Oct 2024 |
Where They Overlap
Incident Reporting
- CRA: Report exploited vulnerabilities to ENISA (24h)
- NIS2: Report significant incidents to CSIRT (24h)
- Both apply? Report to both if you’re a manufacturer AND an essential entity
Supply Chain Security
- CRA: SBOM, vulnerability management for products
- NIS2: Supply chain risk management for the organization
- Both apply? Your SBOM fulfills part of your NIS2 supply chain obligations
Security by Design
- CRA: Mandatory for all products
- NIS2: Required as part of organizational measures
- Both apply? Security by design in your products helps meet NIS2 organizational requirements
Who Is Subject to Both?
Organizations that:
- Manufacture software products (CRA) AND
- Operate essential/important services (NIS2)
Examples:
- Cloud service providers who also sell software products
- Telecom operators who manufacture network equipment
- Healthcare technology companies (device manufacturer + service provider)
Compliance Synergies
If you’re subject to both, many activities serve dual purpose:
CRA Requirement → NIS2 Benefit
─────────────────────────────────────────
SBOM generation → Supply chain risk assessment
Vulnerability handling → Incident management
Security by design → Risk management measures
Security testing → Security audit requirements
Technical documentation → Governance documentationAction Plan for Dual Compliance
- Single security team — don’t create separate CRA and NIS2 teams
- Unified incident reporting — one process, two notification channels
- Shared risk assessment — product risks and organizational risks overlap
- Combined documentation — technical docs serve both regulatory requirements
- Integrated audit — one audit program covering both regulations
Subject to both CRA and NIS2? I help organizations build unified compliance programs. Get in touch.
📌 Need expert help with this topic?
Luca Berton
AI & Cloud Advisor with 18+ years experience. Author of 8 technical books, creator of Ansible Pilot, and instructor at CopyPasteLearn Academy. Speaker at KubeCon EU & Red Hat Summit 2026.
Related Articles
Fix: OpenClaw Gateway non-loopback control UI requires gateway.controlui.allowedorigins
Getting the allowedorigins error when starting your OpenClaw gateway? Here is exactly how to fix it, with step-by-step configuration for local network, VPS, and reverse proxy setups.
Fix: OpenClaw Model API Key Errors — 401 Unauthorized, Invalid Key, and Rate Limits
Troubleshoot OpenClaw API key issues across OpenAI, Anthropic, and GitHub Copilot. Covers 401 errors, invalid key formats, rate limits, and model fallback configuration.