As European organizations prepare for new cybersecurity regulations, many are wondering how DORA and NIS2 relate to each other. While both aim to strengthen digital resilience, they have distinct focuses and requirements.

Overview of Each Regulation

DORA (Digital Operational Resilience Act)

DORA specifically targets financial entities and creates a comprehensive framework for ICT risk management in the financial sector. It covers approximately 20,000+ entities including banks, insurance companies, investment firms, and their critical ICT service providers.

NIS2 (Network and Information Security Directive)

NIS2 is broader in scope, covering essential and important entities across multiple sectors including energy, transport, health, and digital infrastructure. It aims to achieve a high common level of cybersecurity across the EU.

Key Differences

Aspect DORA NIS2
Sector Focus Financial services only Multiple critical sectors
Scope ICT operational resilience Broader cybersecurity measures
Testing Requirements Threat-led penetration testing (TLPT) Less specific testing requirements
Third-Party Oversight Direct EU supervision of critical providers Entity responsible for supplier security
Incident Reporting Detailed financial sector reporting Broader incident notification

Overlaps and Complementarity

For financial institutions, both regulations apply. However, DORA is considered lex specialis - meaning it takes precedence for financial entities on matters it specifically addresses. Organizations must comply with:

  • DORA requirements for ICT operational resilience
  • NIS2 requirements not specifically covered by DORA

Practical Implications

For Financial Institutions

  1. DORA provides the primary framework for ICT risk management
  2. NIS2 may add requirements in areas not explicitly covered by DORA
  3. Governance structures should address both regulations
  4. Incident reporting must meet both frameworks

For ICT Service Providers

Critical ICT service providers to financial institutions will face:

  • Direct oversight under DORA
  • Potential NIS2 obligations if serving other sectors
  • Need for integrated compliance programs

Compliance Strategy

Organizations subject to both regulations should:

  1. Map Requirements: Identify overlaps and unique requirements
  2. Integrated Approach: Create unified governance structures
  3. Prioritize DORA: For financial institutions, ensure DORA compliance first
  4. Gap Analysis: Identify NIS2 requirements not covered by DORA
  5. Unified Documentation: Maintain integrated compliance evidence

Timeline Considerations

  • DORA: Applicable from January 17, 2025
  • NIS2: Member states must transpose by October 17, 2024, with application by October 17, 2024

Conclusion

While DORA and NIS2 have different focuses, financial institutions can leverage synergies between them. A well-designed compliance program can address both efficiently, avoiding duplication while ensuring comprehensive coverage of all requirements.