NIS2 vs. DORA: differences and delimitation
What is each one about?
NIS2 (Directive (EU) 2022/2555) is a cross-sector EU directive that aims to establish a high common level of cybersecurity and is transposed nationally. The obligations apply from the dates set in the national laws. DORA (Regulation (EU) 2022/2554, the Digital Operational Resilience Act) is a directly applicable EU regulation specifically for the financial sector. It bundles the requirements for the digital operational resilience of financial entities and their ICT service providers and has applied since 17 January 2025.
NIS2 and DORA compared
| Aspect | NIS2 | DORA |
|---|---|---|
| Legal form | Directive (EU) 2022/2555, national transposition required | Regulation (EU) 2022/2554, applies directly |
| Scope | Cross-sector (energy, health, transport, manufacturing and many more) | Financial sector (banks, insurers, investment firms and others) plus ICT third-party providers |
| Applies since | Through national transposition laws (deadline 17 October 2024) | EU-wide since 17 January 2025 (Art. 64) |
| Reporting chain | Early warning 24 h · notification 72 h · final report 1 month (Art. 23) | Initial notification 4 h after classification (max. 24 h) · intermediate report 72 h · final report 1 month (Delegated Regulation (EU) 2025/301) |
| Focus | Cyber risk management, reporting obligations, governance | Digital operational resilience: risk management, incidents, testing, third parties |
| Testing obligation | Assess effectiveness, crisis capability (Art. 21) | Annual testing programme (Art. 24) including TLPT every 3 years for designated entities (Art. 26) |
| Sanctions | up to EUR 10 million / 2 % or EUR 7 million / 1.4 % of worldwide turnover | administrative penalties, designed nationally (Art. 50 et seq.) |
Lex specialis: why DORA takes precedence for financial entities
NIS2 Art. 4 governs the relationship with sector-specific EU legal acts: where such acts provide for requirements that are at least equivalent to NIS2, they take precedence. For financial entities within the scope of DORA that means: DORA displaces NIS2 for the areas it covers. The national transposition laws confirm this by exempting DORA financial entities from the core NIS2 obligations (risk management, reporting, evidence). This avoids double regulation.
Important for groups: the precedence applies per entity and per area. A group can fall under DORA with its bank and at the same time under NIS2 with an industrial or IT subsidiary. So check each legal entity individually.
Where do the obligations differ most clearly?
- Speed of reporting: DORA requires the initial notification within 4 hours of classification (max. 24 h after becoming aware), NIS2 the early warning within 24 hours.
- Testing obligation: NIS2 requires an assessment of effectiveness and crisis capability (Art. 21). DORA prescribes a formal, annual testing programme, including TLPT every three years for designated entities.
- Third parties: DORA regulates ICT service providers directly (register of information, EU oversight of critical providers); NIS2 addresses the supply chain as a risk-management element of the entity.
- Sanctions logic: NIS2 sets EU-wide uniform maximum fines; DORA leaves the design of penalties to the member states (Art. 50 et seq.).
The common ground: test and exercise
Both frameworks require more than documentation. The effectiveness of the measures must be evidenced. NIS2 requires the assessment of the measures and crisis capability. DORA requires a binding testing programme with scenario-based tests and response and recovery plans tested yearly. Tabletop exercises fit both frameworks and can be documented in an auditable way. In them your team trains the reporting chain that has to work under 4-hour or 24-hour pressure in a real incident.
Frequently asked questions
Does NIS2 or DORA apply to my financial entity?
For financial entities within the scope of DORA, DORA applies as lex specialis. Under NIS2 Art. 4, sector-specific EU legal acts with at least equivalent requirements take precedence. The national NIS2 laws confirm this and exempt DORA financial entities from the core NIS2 obligations.
What is the main difference between NIS2 and DORA?
NIS2 is a cross-sector cybersecurity directive that is transposed nationally. DORA is a directly applicable EU regulation specifically for the financial sector with a focus on digital operational resilience, including mandatory resilience testing.
Are the reporting deadlines the same under NIS2 and DORA?
Similar, but not identical. Both are staged in three steps up to a final report after one month. NIS2 requires the early warning within 24 hours of becoming aware. DORA is stricter: the initial notification is due within 4 hours of classifying the incident as major, at the latest 24 hours after becoming aware. The intermediate report follows 72 hours after the initial notification.
Note: This article is for general information and is not legal advice. The applicable laws and regulations, and the current state of national transposition, take precedence.