DORA’s second year shifts focus to proving ICT controls work, with network evidence supporting monitoring, detection, and incident response.