NIS2 and DORA: Key Differences and Overlaps

NIS2 is a broad sectoral directive. DORA is a regulation specific to the financial sector. Both reached the European market in the same period, and many organizations are asking which framework applies to them and how to manage both at once.

At the end of 2024 and beginning of 2025, the European market saw two major cybersecurity and digital resilience frameworks enter into force in a very short period: NIS2 in October 2024 and DORA in January 2025. For many organizations, especially in the financial and technology sectors, the immediate question was the same: does one apply to us, the other, or both? What happens when they coincide?

Both frameworks share terminology, general objectives and some similar technical requirements. But they have different legal natures, different scopes and a logic of interaction that has important practical consequences.

Different origins and legal natures

NIS2 is a European directive. Directives are not directly applicable in Member States, they require transposition into national law, allowing some margin of adaptation in thresholds, penalties and supervisory mechanisms. The concrete NIS2 requirements applying to a company are established by national transposition legislation, not by the directive text directly.

DORA is a European regulation. Regulations are directly applicable in all Member States from their entry into force date, without transposition, giving DORA greater legal uniformity across the EU. This distinction has a practical consequence: DORA is more predictable in its specific requirements than NIS2.

Scope: who falls under each framework

NIS2 has a broad sectoral scope, covering highly critical sectors (energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration and space) and important sectors (postal services, waste management, chemicals, food, critical product manufacturing, digital providers and research).

DORA has a sector-specific scope: the financial sector. It applies to credit institutions, investment firms, payment and electronic money institutions, crypto-asset service providers under MiCA, alternative investment fund managers, occupational pension funds, insurers, credit rating agencies, statutory auditors and, significantly, third-party ICT service providers deemed critical for financial entities.

The lex specialis principle: what happens when both apply

Article 4 of NIS2 establishes that when Member States apply the directive to entities already subject to equivalent sectoral regulation, they must take into account the provisions of that sectoral regulation to avoid duplication. In practice, financial entities subject to DORA are not required to additionally comply with NIS2 risk management and incident requirements separately, because DORA is considered the specific framework for that sector.

However, the exemption is not total in all respects. NIS2 remains relevant for financial entities in aspects DORA does not fully cover, such as certain national supervision obligations or notification to national CSIRTs in specific scenarios. The most complex scenario is that of ICT providers serving the financial sector: they may be classified as important or essential entities under NIS2 as digital service providers, and simultaneously fall under direct DORA supervision if designated as critical providers by the European Supervisory Authorities (ESAs). In that case, both frameworks run in parallel.

Key differences in requirements

Resilience testing. DORA establishes a digital operational resilience testing program with basic annual tests for all entities and advanced threat-led penetration tests (TLPT) for the most significant entities every three years. NIS2 requires security controls but does not specify as detailed a testing regime.

Third-party ICT management. DORA dedicates an entire chapter to third-party ICT risk management, with specific requirements on vendor contracts, and creates a direct supervisory regime for critical ICT providers. NIS2 also requires supply chain management, but with less detail.

Incident notification. Both require rapid notification of significant incidents, but recipients differ. DORA requires notification to the competent financial supervisory authority; NIS2 requires notification to the national CSIRT. A financial entity affected by an incident may need to notify both concurrently.

Governance and management accountability. Both establish senior management accountability, but DORA is more specific: it requires the management body to formally approve the ICT resilience strategy and receive regular training on ICT risks.

Overlaps: what both frameworks share

The overlaps are substantial and, well managed, allow building a single program that produces evidence valid for both frameworks: ICT risk management (a formal, documented process for identifying, assessing and treating cybersecurity risks); business continuity and disaster recovery; staff training and awareness; and incident management (detection, classification, containment, recovery and post-incident documentation).

Critical ICT providers: the category falling under both

The most complex case is technology companies providing services to the financial sector. Under NIS2, a cloud, data center or managed security service provider may be classified as an important or essential entity if they exceed size thresholds. Under DORA, that same provider may be designated a "critical third-party ICT provider" (CTPP) by the ESAs if a significant number of European financial entities depend on their services. CTPP designation means direct supervision by European authorities, including inspection visits and information requests.

How to build a program covering both NIS2 and DORA

Build the common controls once with sufficient specificity to satisfy both frameworks: a management-approved security policy, critical asset and system inventory, risk assessment with documented methodology, incident management process with both frameworks' notification timelines integrated, continuity plan with cyberattack scenarios, and staff training program. Then add the DORA-specific requirements on top: the resilience testing program with TLPT where applicable, specific ICT vendor contract documentation, ICT critical provider exit plans, and third-party information registers in the ESA-required format.

How CB Partners helps

The question generated by the NIS2-DORA intersection is legal, operational and strategic at the same time. We work with financial entities, ICT providers and companies operating in sectors covered by NIS2 through a structured four-phase process: scope analysis (determining precisely whether the organization falls within NIS2, DORA, both, or neither); differential gap analysis for each applicable framework; program design and implementation starting from the common layer; and evidence documentation and supervision preparation, including support through the first inspection.

Frequently Asked Questions