Financial services organizations must comply with both NIS2 and DORA. While DORA is the sector-specific regulation (lex specialis) that takes precedence where requirements overlap, NIS2 still applies and may impose additional obligations. Understanding the relationship between these two regulations is critical for efficient compliance.

Scope

NIS2 covers essential and important entities across multiple sectors. Banks and financial market infrastructure are classified as essential entities. DORA covers a comprehensive list of financial entities: credit institutions, payment institutions, investment firms, insurance and reinsurance undertakings, crypto-asset service providers, and their critical ICT third-party providers. DORA’s scope within financial services is more granular and exhaustive than NIS2’s.

Lex Specialis Principle

Where DORA and NIS2 overlap, DORA takes precedence as the sector-specific regulation. The EU AI Act recital and NIS2 Article 4 explicitly acknowledge this. However, NIS2 requirements that go beyond DORA’s scope still apply. In practice, an organization that fully complies with DORA will meet most NIS2 requirements, but should verify coverage of any NIS2-specific obligations.

Risk Management Comparison

AspectNIS2DORA
ScopeGeneral cybersecurity riskICT risk specifically
SpecificityTen areas of measuresFive detailed pillars
Supply chainSecurity of direct suppliersDetailed third-party ICT risk framework
TestingAppropriate testingSpecific testing program including TLPT
Third-party oversightAssessment of suppliersContractual provisions, exit strategies, concentration risk

DORA’s requirements are more prescriptive and detailed than NIS2’s, particularly regarding third-party ICT risk management and resilience testing.

Incident Reporting

NIS2 requires early warning within 24 hours, incident notification within 72 hours, and a final report within one month, reported to national CSIRTs. DORA requires initial notification, intermediate reports, and a final report using specific templates defined by the European Supervisory Authorities, reported to financial competent authorities. The timelines are broadly similar, but the reporting channels and templates differ. Organizations should establish processes that can satisfy both reporting requirements simultaneously.

Third-Party Risk

This is where DORA goes significantly further than NIS2. DORA requires specific contractual provisions for ICT service providers (including audit rights, data location, and exit strategies), concentration risk assessment when multiple functions depend on the same provider, and oversight of critical ICT third-party providers by European Supervisory Authorities. NIS2 requires supply chain security assessment but with less prescriptive detail.

Enforcement

NIS2 fines up to 10M EUR or 2% of turnover for essential entities, with personal liability for management. DORA fines determined by national competent authorities per member state law, with the European Supervisory Authorities empowered to impose periodic penalty payments on critical ICT third-party providers.

Practical Compliance Approach

Start with DORA compliance as the more detailed and prescriptive framework. Map DORA controls to NIS2 requirements to identify any gaps. Address NIS2-specific obligations not covered by DORA. Establish unified incident reporting processes that satisfy both frameworks. Use a single risk management system that meets DORA’s ICT risk requirements while also covering NIS2’s broader cybersecurity risk areas.