Two pieces of EU legislation now define how organisations must manage cyber risk: the NIS2 Directive and the Digital Operational Resilience Act (DORA). They overlap heavily, use similar language and were negotiated at the same time – so it’s no surprise that many IT teams aren’t sure which one applies to them, or whether both do.
This article explains the difference in plain terms, compares the requirements that matter most to IT – risk management, backup and recovery, incident reporting, testing and third-party risk – and ends with a practical to-do list.
Disclaimer: This is practical guidance for IT professionals, not legal advice. Check with your compliance team and supervisory authority.
The short answer
- DORA is a regulation for the financial sector: banks, insurers, investment firms, payment and e-money institutions, crypto-asset service providers, fund managers and more – about 20 types of financial entities. It applies directly in every EU member state and has applied since 17 January 2025.
- NIS2 is a directive covering 18 sectors – energy, transport, health, manufacturing, digital infrastructure, public administration and others. Each member state turns it into national law, so details vary by country.
- For financial entities, DORA takes precedence. DORA is lex specialis: where it covers the same ground as NIS2, DORA’s rules apply instead.
- IT service providers can be affected by both. An MSP or cloud provider may fall under NIS2 directly and face DORA requirements through contracts with financial customers.
Side-by-side comparison
| DORA | NIS2 | |
|---|---|---|
| Legal form | EU Regulation (2022/2554) – directly applicable | EU Directive (2022/2555) – transposed into national law |
| Applies since | 17 January 2025 | National laws from October 2024 onwards (many countries late) |
| Who | Financial entities + critical ICT third-party providers | Essential and important entities in 18 sectors |
| Focus | Digital operational resilience of the financial system | Cybersecurity risk management across critical sectors |
| Supervisor | Financial regulators (national + EBA, EIOPA, ESMA) | National cybersecurity authorities / CSIRTs |
| Level of detail | Very prescriptive, plus detailed technical standards | Principle-based, details in national law and implementing acts |
| Backup rules | Article 12 + technical standards | Article 21(2)(c) + Implementing Regulation 2024/2690 for digital entities |
| Incident reporting | Initial notification within 4 h of classification (max. 24 h after detection), intermediate 72 h, final 1 month | Early warning 24 h, notification 72 h, final report 1 month |
| Resilience testing | Annual testing programme; threat-led penetration testing (TLPT) every 3 years for significant entities | Effectiveness assessment required, no mandatory TLPT |
| Third-party risk | Detailed: register of information, mandatory contract clauses, exit strategies, EU oversight of critical providers | Supply chain security as one of the risk measures |
| Fines | Set by member states; critical providers face periodic penalties | Up to €10M / 2% (essential) or €7M / 1.4% (important) of global turnover |
What it means for IT, area by area
1. ICT risk management framework
Both laws require a documented risk management framework approved and overseen by management. DORA goes further: it expects a complete ICT risk management framework with identified and classified ICT assets, documented dependencies, a digital operational resilience strategy, and an annual review. The management body is explicitly responsible and must keep its ICT knowledge up to date.
For IT: expect to maintain an accurate asset inventory, map which systems support which business functions, and document everything.
2. Backup and recovery
This is where DORA is noticeably more specific. Article 12 requires financial entities to:
- document backup policies defining the scope and frequency of backups based on data criticality and confidentiality
- document restoration and recovery procedures
- set up backup systems that can be activated without compromising security or data integrity
- test backup and recovery procedures periodically
- restore to ICT systems that are physically and logically segregated from the source system and protected from unauthorised access or corruption
- maintain redundant ICT capacity (except microenterprises, which only need to assess whether it’s necessary)
- set RTO and RPO for each function, taking into account whether it’s critical or important – and make sure agreed service levels can be met even in extreme scenarios
- after an incident, run integrity checks and reconciliations so data stays consistent across systems
Central securities depositories must additionally run a secondary processing site far enough from the primary one to have a different risk profile.
Under NIS2, Article 21(2)(c) is brief – „business continuity, such as backup management and disaster recovery“ – with detail coming from national laws and, for digital providers, Implementing Regulation 2024/2690. We cover that in NIS2 Backup Requirements Explained.
For IT, the practical difference: DORA’s requirement to restore into segregated systems pushes many financial entities towards isolated recovery environments („clean rooms“), immutable storage and regular full-recovery tests – not just file-level restore checks.
3. Incident reporting
Both laws require fast reporting of serious incidents, but the triggers and clocks differ:
- DORA: major ICT-related incidents are classified using defined criteria (clients affected, duration, data loss, criticality of services, geography, economic impact). The initial notification is due within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it. Then an intermediate report within 72 hours and a final report within one month.
- NIS2: significant incidents need an early warning within 24 hours, a notification within 72 hours and a final report within one month.
For IT: you need monitoring and logging good enough to answer the classification questions quickly – how many users, which services, how long, what data. That’s an operational requirement, not just a policy.
4. Resilience testing
DORA requires an annual digital operational resilience testing programme – vulnerability scans, network security assessments, scenario-based tests, performance tests and more. Significant financial entities must also run threat-led penetration testing (TLPT) at least every three years, based on the TIBER-EU framework.
NIS2 asks for policies to assess the effectiveness of security measures, but doesn’t mandate TLPT.
For IT: budget for testing, and include backup and DR tests in the programme – they’re part of resilience testing under DORA.
5. ICT third-party risk
This is DORA’s most demanding area and the one that reaches beyond the financial sector:
- financial entities must keep a register of information listing all contracts with ICT service providers
- contracts must contain mandatory clauses – service levels, data location, audit rights, incident support, termination rights and exit strategies
- concentration risk must be assessed
- critical ICT third-party providers (CTPPs) are supervised directly at EU level. In November 2025, the European Supervisory Authorities designated the first 19 CTPPs, including AWS, Google Cloud, Microsoft, Oracle, SAP and Deutsche Telekom
NIS2 also requires supply chain security, but in far less detail.
For IT service providers and MSPs: if you have financial-sector customers, expect contract amendments, audit requests and questions about your backup, incident response and exit support – even if you’re not a CTPP.
Which one applies to you?
You’re a bank, insurer, investment firm, payment institution or similar → DORA applies. NIS2’s overlapping rules are replaced by DORA, though some national NIS2 obligations (e.g. registration) may still apply depending on your country.
You’re in energy, health, manufacturing, transport, public sector, digital infrastructure, etc. → NIS2 (via national law) applies. DORA doesn’t, unless you also provide ICT services to financial entities.
You’re an MSP, cloud provider, data centre or software vendor → possibly both: NIS2 directly as a digital provider, and DORA indirectly through financial customers‘ contracts.
You’re a small company outside these sectors → neither may apply directly, but your customers‘ supply chain requirements increasingly will.
Practical to-do list for IT teams
Whether DORA, NIS2 or both apply, the IT work overlaps by roughly 80%. Build it once:
Governance and documentation
- Asset inventory linked to business functions and their criticality
- Documented ICT risk management framework, reviewed at least annually
- Backup policy defining scope, frequency and retention by data classification
- RTO/RPO per critical function, approved by the business
Backup and recovery
- At least one immutable or offline copy of critical data
- Ability to restore into a segregated recovery environment
- Redundant capacity for critical systems
- Regular, documented restore tests, including at least one full recovery exercise per year
- Integrity checks after restores (checksums, reconciliation for transactional data)
Incident response
- Incident classification criteria mapped to DORA and/or NIS2 thresholds
- Reporting workflow that can meet a 4-hour (DORA) or 24-hour (NIS2) deadline – including weekends
- Logging and monitoring that provide the data needed for reports
Third parties
- Register of all ICT providers, including backup software and cloud storage vendors
- Contracts reviewed for security, data location, audit and exit clauses
- Exit plan for critical providers – including how you’d get your backups out
Testing
- Annual resilience testing programme (vulnerability scans, scenario tests, DR tests)
- TLPT planning if you’re a significant financial entity
Much of this evidence also helps with cyber insurance renewals and ISO 27001 audits.
FAQ
Does NIS2 apply to banks?
Banks are listed as a NIS2 sector, but DORA is lex specialis for financial entities. Where DORA sets equivalent requirements – which covers ICT risk management, incident reporting and testing – DORA applies instead of NIS2.
When did DORA start to apply?
DORA entered into force in January 2023 and has applied since 17 January 2025.
What does DORA require for backups?
Article 12 requires documented backup policies and recovery procedures, periodic testing, restoration into physically and logically segregated systems, redundant ICT capacity, and RTO/RPO defined per function – including for extreme scenarios.
Does DORA apply to IT service providers?
Not directly, unless the provider is designated as a critical ICT third-party provider. But financial entities must impose DORA-aligned contract terms, audits and exit requirements on their ICT suppliers, so most providers serving the financial sector are affected indirectly.
Is DORA stricter than NIS2?
In most IT areas, yes – DORA is more prescriptive on backup, testing, incident classification and third-party risk. NIS2 is broader in scope but generally less detailed.
Conclusion
DORA and NIS2 share the same goal – organisations that can withstand and recover from cyber incidents – but they get there differently. DORA is detailed and financial-sector specific; NIS2 is broader and shaped by national law.
For IT teams, the practical message is the same under both: know your assets, protect your backups, test your recovery, report fast and manage your suppliers. Build those capabilities once, document them well, and you’ll be ready for whichever regulator – or auditor, or insurer – comes asking.
Related reading:
Napsat komentář