DORA vs NIS 2 is a question most European security teams have had to answer: which law applies to us? DORA is a regulation for the financial sector. NIS 2 is a directive for essential and important entities across 18 sectors. This guide compares scope, requirements, reporting deadlines and penalties, and explains what happens when both seem to apply.
Key points
- DORA, Regulation (EU) 2022/2554, has applied since 17 January 2025 to financial entities and their critical ICT providers.
- NIS 2, Directive (EU) 2022/2555, had to be written into national law by 17 October 2024. The rules you follow are in each member state’s law.
- For financial entities, DORA takes priority over NIS 2 on ICT risk management and incident reporting.
- Both make the management body accountable and both require training.
- ICT suppliers to banks and insurers can be pulled into DORA through contracts even if they are not financial entities.
DORA vs NIS 2 at a glance
| DORA | NIS 2 | |
|---|---|---|
| Legal form | Regulation, applies directly in every member state | Directive, applied through national laws |
| Who | Banks, insurers, investment firms, payment and crypto-asset providers and other financial entities; critical ICT third-party providers | Essential and important entities in sectors such as energy, transport, health, digital infrastructure, public administration and manufacturing |
| Focus | Digital operational resilience of the financial sector | Cybersecurity of networks and information systems |
| First incident report | Within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware | Early warning within 24 hours of becoming aware of a significant incident |
| Testing | Testing programme, with threat-led penetration testing for larger entities | Policies to assess the effectiveness of measures |
| Supervisor | Financial supervisors | National cybersecurity authorities |
What DORA requires
DORA is built on five areas:
- ICT risk management: a framework approved and overseen by the management body.
- Incident management and reporting: classify ICT incidents and report major ones in three stages.
- Resilience testing: a risk-based programme, including advanced testing for significant entities.
- ICT third-party risk: a register of contracts, mandatory contract clauses and exit plans.
- Information sharing: voluntary exchange of threat intelligence.
Read more in our guide to DORA.
What NIS 2 requires
NIS 2 asks entities to take appropriate and proportionate measures. Article 21 lists ten areas, including risk analysis, incident handling, business continuity, supply chain security, secure development, cryptography, access control and multi-factor authentication. Significant incidents are reported in stages: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
Fines can reach EUR 10 million or 2% of worldwide turnover for essential entities, and EUR 7 million or 1.4% for important entities. Details are in our NIS 2 Directive guide.
When both seem to apply
A bank is a financial entity under DORA and banking is also a NIS 2 sector. To avoid double regulation, NIS 2 states that where a sector-specific EU law sets requirements of at least equivalent effect, that law applies instead. DORA is such a law. A financial entity therefore follows DORA for ICT risk management and incident reporting, not the matching NIS 2 provisions.
Two cautions. Member states may still involve financial entities in national cybersecurity strategies and information sharing. And a group with non-financial subsidiaries, such as a data centre or managed service company, may have entities under each law.
If you supply ICT services
A cloud, software or managed service provider is usually in scope of NIS 2 in its own right. If it serves financial entities, its customers must pass DORA requirements down through contracts: audit rights, incident assistance, exit support and location of data. Providers designated as critical are supervised directly at EU level.
One programme for both
The laws share a foundation: governance by the management body, risk assessment, incident handling, continuity, supplier control and training. An information security management system based on ISO/IEC 27001 and a continuity programme based on ISO 22301 cover a large part of both. Build one set of controls, then add the specific reporting and contract rules of each law.
Training
For the financial sector, see DORA Lead Manager. For NIS 2, see NIS 2 Directive Lead Implementer. For the management system underneath both, see ISO/IEC 27001 Lead Implementer.
Sources: Regulation (EU) 2022/2554, DORA and Directive (EU) 2022/2555, NIS 2 (EUR-Lex).
Frequently asked questions
Does a bank have to comply with both DORA and NIS 2?
For ICT risk management and incident reporting, a bank follows DORA, which takes priority as the sector-specific law. National rules may still involve financial entities in wider cybersecurity cooperation.
Is DORA stricter than NIS 2?
DORA is more detailed. It sets specific rules for testing, contracts with ICT providers and a register of those contracts. NIS 2 is broader in the sectors it covers and leaves more to national law.
Does DORA apply to companies outside the EU?
It applies to financial entities in the EU. ICT providers outside the EU are affected when they serve those entities, through contract requirements and, if designated critical, direct oversight.
Does ISO/IEC 27001 certification satisfy DORA or NIS 2?
No, but it helps. ISO/IEC 27001 covers much of the risk management both laws expect. You still need the law-specific parts, such as reporting deadlines and supplier registers.
