DORA guide
DORA vs NIS2: which applies to your financial entity, your group companies and your ICT providers
For financial entities covered by DORA, its ICT risk, reporting, testing and third-party rules apply instead of NIS2's. This guide compares the two side by side and shows where NIS2 still reaches a financial group and its ICT providers.
Key points
- For a financial entity covered by DORA, Regulation (EU) 2022/2554, DORA's rules on ICT risk, incident reporting, testing, third parties and information sharing apply in place of the matching NIS2 rules.
- NIS2, Directive (EU) 2022/2555, still matters to a financial group: for entities outside DORA's list, for non-financial subsidiaries such as a group IT or data centre company, and for national cyber crisis arrangements.
- An ICT provider serving EU finance can meet both: DORA through client contracts and, if designated, EU oversight; NIS2 in its own right as, for example, a cloud provider.
- Classify each legal entity separately before building anything. One control set can then serve both laws, with separate reporting routes.
DORA vs NIS2: the short answer
If your firm appears in DORA's Article 2 list of financial entities, DORA is the law that governs your ICT risk management, incident reporting, resilience testing and ICT third-party risk. NIS2 steps back for those subjects. The Regulation says so in Article 1(2), which makes it a sector-specific Union legal act for the purposes of Article 4 of NIS2, and its recital 16 calls it lex specialis with regard to the Directive.
NIS2 makes the same point from its own side. Recital 28 of the Directive states that Member States should not apply its cybersecurity risk-management and reporting obligations, or its supervision and enforcement, to financial entities covered by DORA. The European Commission's Article 4 guidelines of 18 September 2023 confirm it.
That settles one entity at a time, rarely a whole group. This guide explains the texts, not legal advice; your national law and competent authority have the final word.
DORA and NIS2 side by side
| What is compared | DORA | NIS2 |
|---|---|---|
| Legal form | EU Regulation, directly applicable in every Member State since 17 January 2025, detailed by Commission technical standards | EU Directive, applied through each Member State's transposing law from 18 October 2024 |
| Who is covered | Twenty types of financial entity in Article 2, from credit institutions and insurers to crypto-asset service providers, plus ICT third-party service providers | Medium-sized and large entities in the 18 sectors of Annexes I and II, some regardless of size; Annex I includes banking and financial market infrastructures |
| Governance | Article 5: the management body defines, approves and oversees the ICT risk framework and bears ultimate responsibility for ICT risk | Article 20: the management body approves the measures, oversees them, can be held liable, and its members follow training |
| Risk management | Articles 6 to 16: a documented ICT risk management framework, reviewed at least yearly, with a simplified version for certain smaller entities | Article 21: appropriate and proportionate measures on an all-hazards basis, including at least ten named measures |
| Incident reporting | Major ICT-related incidents to the competent authority: initial notification within four hours of classification and no later than 24 hours from awareness, intermediate report within 72 hours of the initial notification, final report within one month of the latest intermediate report | Significant incidents to the CSIRT or competent authority: early warning within 24 hours of awareness, notification within 72 hours, final report within one month of the notification |
| Testing | A yearly risk-based testing programme for systems supporting critical or important functions; threat-led penetration testing at least every three years for entities the authority identifies | Policies and procedures to assess the effectiveness of the measures; no mandated testing cycle in the Directive |
| Suppliers | A register of information on all ICT contractual arrangements, Article 30 contract terms, exit strategies and EU oversight of designated critical providers | Supply chain security as one of the ten measures, weighing the vulnerabilities of each direct supplier |
| Supervisor | The financial competent authority, usually the national supervisor and the ECB for significant banks | The national competent authority and CSIRT named in the transposing law |
| Penalties | Set by each Member State under Article 50; no EU-wide maximum for financial entities | Maximum fines of at least 10 million euros or 2% of worldwide turnover for essential entities, and 7 million euros or 1.4% for important entities, whichever is higher |
Neither law offers a certificate; both are supervised on evidence. How ISO/IEC 27001 and ISO 22301 fit alongside them is covered in DORA vs NIS2, ISO/IEC 27001 and ISO 22301.
Which law applies to which entity in a financial group
The test is applied per legal entity, not per group or brand. Ask four questions of every company in the group.
1. Is the entity on DORA's Article 2 list?
Credit institutions, payment and e-money institutions, investment firms, insurers, fund managers, trading venues, central counterparties, crypto-asset service providers and the other listed types answer yes, subject to the exclusions in Article 2(3), such as small insurance intermediaries. If yes, DORA governs the subjects above.
2. Would NIS2 also have caught it?
Banking and financial market infrastructures are Annex I sectors, so many banks and market infrastructures would be NIS2 entities if DORA did not exist. Insurance, payment services and asset management are not named as sectors in either NIS2 annex. For the first group, DORA replaces the NIS2 rules; for the second, NIS2 was never the operative law for these activities.
3. Does the entity do something NIS2 lists in its own right?
A group company that runs a data centre, provides cloud or managed services to third parties, or operates another Annex I or II activity is classified on that activity. If it is not itself a DORA financial entity, DORA's lex specialis rule does not shelter it, and NIS2 may apply through the national law where it is established or, for several digital services, where it has its main establishment in the Union.
4. Which national arrangements survive?
The Commission's guidelines note that NIS2's national cyber crisis management frameworks and the EU-CyCLONe network continue to apply, and that DORA authorities may cooperate with NIS2 single points of contact, CSIRTs and authorities. The detailed essential and important classification is explained in Essential or important? The scope and size rules.
ICT providers to financial entities: often both
A cloud, software, data centre or managed service company serving EU banks and insurers usually meets DORA indirectly: its clients stay fully responsible for outsourced ICT under Article 28, record it in their register of information and contract on the Article 30 terms, so the provider sees DORA as clauses, audit rights, incident assistance and exit support. Providers the European Supervisory Authorities designate as critical, 19 in the first list of 18 November 2025, also face direct oversight by a Lead Overseer.
The same company may be a NIS2 entity in its own right. Implementing Regulation (EU) 2024/2690 applies detailed NIS2 requirements to cloud computing, data centre, managed service and managed security service providers, among others. A provider established outside the Union but offering these services in it must designate a representative in a Member State where it offers them. The contract side is covered in DORA for ICT providers: the Article 30 contract terms.
Running one programme for both
Where a group has DORA and NIS2 entities side by side, two separate projects duplicate most of the work: board duties, asset inventory, access control, cryptography, continuity and supplier assessment overlap heavily. What must stay separate is narrower.
| Area | Can be shared | Must stay separate |
|---|---|---|
| Governance | One board briefing and training cycle covering both duties | Approval records per entity, naming the law each entity answers to |
| Controls | One policy set and control library | DORA's simplified framework where Article 16 applies; national NIS2 additions |
| Incidents | One detection, triage and escalation process | Classification rules and report templates: DORA's major-incident criteria versus NIS2's significance test, and different recipients |
| Suppliers | One due-diligence method and contract library | The DORA register of information on the prescribed templates |
| Testing | One vulnerability and penetration testing schedule | DORA's yearly programme scope and any threat-led penetration testing |
The incident clock goes wrong most often: a team that learns NIS2's 24-hour early warning can miss that DORA's initial notification runs from classification as well as from awareness, and that its later reports are timed differently. The reporting rules are explained in Major ICT-related incidents: classification and reporting deadlines.
How Sterling maps DORA and NIS2
One entity map, one control set, the right reporting route for each company
Sterling's expert and experienced consultants start with a gap analysis that classifies every legal entity against DORA's Article 2 and the NIS2 annexes as your national laws apply them, then build one framework with separate registers, classification rules and report templates where the laws differ. Everything is held in Effivity, used in 50+ countries, and your people learn through Sterling Academy. We ensure a successful DORA compliance programme for our clients; supervision stays with your competent authority, and legal questions on classification stay with your counsel.
Book a free discovery callDORA vs NIS2: questions buyers ask
Is an insurance company covered by NIS2 or DORA?
An insurer or reinsurer is covered by DORA, which lists insurance and reinsurance undertakings in Article 2. Insurance is not named as a sector in either NIS2 annex, so NIS2 does not reach the insurance activity itself; a group company carrying out a listed NIS2 activity, such as a data centre service offered to others, is assessed separately.
Does a bank report the same cyber incident under both DORA and NIS2?
No: a credit institution covered by DORA reports major ICT-related incidents to its financial competent authority under DORA, and NIS2's reporting obligation does not apply to it. DORA authorities may cooperate with the NIS2 CSIRTs, single points of contact and authorities, but that cooperation is between the authorities, not a second filing by the bank.
Our group has a separate IT services company. Which law covers it?
It depends on what that company does and whether it is itself a DORA financial entity. Serving only the group, it is an ICT third-party service provider recorded in their register of information; running cloud, data centre or managed services for outside customers above the size rule, it may be a NIS2 entity.
We are a cloud provider serving EU banks. Are we under DORA, NIS2 or both?
Often both, in different ways. NIS2 can apply to a cloud computing service provider directly, with detailed requirements in Implementing Regulation (EU) 2024/2690, while DORA reaches you through your bank clients' contracts and, if the European Supervisory Authorities designate you as critical, through direct oversight.
Which fines can a DORA financial entity face: DORA's or NIS2's?
DORA's, as set by the Member State. DORA's Article 50 leaves administrative penalties to national law, and NIS2's fine maxima attach to NIS2 duties that do not apply to entities covered by DORA.
Can one compliance programme cover DORA and NIS2 across a group?
Yes, if it starts from an entity-by-entity classification. Controls, training and supplier due diligence are shared; the DORA register, the two incident rules and the reporting routes stay separate.
More DORA guides
Every guide in the DORA series is written for one question and links back to the hub for the whole picture.
Keep exploring
Explore more about DORA
Watch a video on how to comply with DORA here.
Watch a video on DORA requirements here.
DORA resources
Talk to a consultant
Map every entity in your group to DORA or NIS2 and build one programme for both.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice