NIS2 vs DORA
NIS2 vs DORA: two EU cyber resilience laws with different audiences. DORA covers the financial sector in detail, NIS2 covers many other sectors.
NIS2 vs DORA comes down to sector. DORA, the Digital Operational Resilience Act, is a regulation for financial entities and the ICT providers they depend on, and it has applied since 17 January 2025. NIS2 is a directive covering many sectors, such as energy, transport, health, digital infrastructure and manufacturing, and each country turns it into national law.
For financial entities, DORA is the specific rule and takes precedence over NIS2 where they overlap. Other covered companies follow NIS2. A company can also be affected indirectly, for example as an IT supplier to a bank.
Side by side
| Capability | NIS2 | DORA |
|---|---|---|
| Full name | Directive (EU) 2022/2555 on network and information security | Regulation (EU) 2022/2554 on digital operational resilience |
| Legal form | Directive, needs national laws, details vary by country | Regulation, applies directly in all member states |
| Who it covers | Essential and important entities across many sectors | Banks, insurers, investment firms, payment and crypto providers and other financial entities, plus critical ICT providers |
| Applies from | Member states had to transpose by 17 October 2024, national timing varies | 17 January 2025 |
| ICT risk management | Required, set at a general level | Required, with more detailed and prescriptive rules |
| Incident reporting | Early warning, notification and final report to national authorities | Major incident reporting to financial supervisors |
| Resilience testing | Expected as part of risk management | Defined testing programme, advanced threat-led testing for significant entities |
| Third-party risk | Supply chain security measures | Detailed contract and register rules for ICT providers |
| Penalties | Up to 10 million euros or 2% of turnover for essential entities, up to 7 million or 1.4% for important entities | Set by national supervisors and the authorities, check your regulator |
What each one is good at
NIS2
- Wide coverage across critical and important sectors
- Flexible, risk-based requirements
- Includes supply chain and management duties
- Raises the baseline for many mid-size companies
- National laws differ between countries
- Less detailed than DORA on testing and providers
- Scope can be hard to judge without advice
DORA
- One directly applicable rule across the EU
- Detailed requirements for ICT risk and testing
- Clear rules for outsourcing to ICT providers
- Takes precedence over NIS2 for financial entities
- Heavy documentation and contract work
- Only for the financial sector and its ICT providers
- Suppliers can be pulled in through client contracts
Look at NIS2 when
- You work in energy, transport, health, digital infrastructure, manufacturing or another covered sector
- You are a managed service, cloud or data centre provider
- You are a medium or large company in a listed sector
- A customer asks you to show NIS2-level security
- You need to check what your country's national law requires
Look at DORA when
- You are a bank, insurer, investment firm, payment or crypto provider or similar financial entity
- You provide ICT services to financial entities
- A financial client is changing your contract for DORA
- You must keep a register of your ICT third-party providers
- Your regulator asks about resilience testing
Questions people ask
Does NIS2 or DORA apply to my company?
What is the main difference in NIS2 vs DORA?
Do financial companies also have to follow NIS2?
When did DORA start to apply?
Not sure how this applies to you?
A senior engineer walks your site, your search presence and the way enquiries reach you, then writes down the three things worth fixing first. You keep the document either way.