Indy Dhami, UK banking cyber lead at KPMG, says this means third-party vendors will need to meet the same standards as banks. “Incident reporting timelines will probably align with NIS2’s 24-72-hour ...