NIS2 vs DORA: what applies to the financial sector

Introduction

For organizations in the financial sector, the regulatory picture is becoming complex: NIS2 and DORA (Digital Operational Resilience Act) partially overlap, and understanding the differences is essential for compliance.

What is DORA?

DORA (EU Regulation 2022/2554) is the European framework for digital operational resilience in the financial sector. Unlike NIS2 (which is a directive), DORA is a regulation - it applies directly, without national transposition.

Entities covered by DORA:

• Credit institutions (banks)
• Payment institutions
• Electronic money institutions
• Investment firms
• Central securities depositories
• Central counterparties
• Trading platforms
• Alternative investment fund managers
• Management companies
• Providers of reporting services
• Credit rating agencies
• Crowdfunding service providers
• Critical ICT service providers for the financial sector

How do NIS2 and DORA interact?

The "lex specialis" principle

DORA is considered special legislation for the financial sector. According to the principle "lex specialis derogat legi generali":

• For financial entities, DORA takes priority over NIS2
• However, certain NIS2 provisions still apply

What applies from NIS2 for financial entities?

According to Romanian OUG 155/2024, entities regulated by DORA must respect from NIS2:

1. Registration obligation with DNSC (Romanian National Cybersecurity Directorate)
2. Provisions on cooperation between authorities
3. Risk identification at national level
4. Information sharing about threats

What does NOT apply from NIS2?

• Requirements for risk management measures (Chapter IV NIS2)
• Incident reporting obligations (DORA provisions apply)
• Supervision and enforcement (DORA provisions apply)

Practical comparison: NIS2 vs DORA

DORA-specific requirements

1. ICT risk management

• Comprehensive risk management framework
• Documented policies and procedures
• Allocation of responsibilities at management level
• Audit of ICT risk function

2. ICT incidents and reporting

• Classification of incidents according to specific criteria
• Reporting to the competent financial authority
• Similar deadlines to NIS2 but with sector-specific details

3. Digital operational resilience testing

• Vulnerability and penetration testing
• Advanced threat-led penetration testing (TLPT) for large entities
• Defined frequency and methodology

4. Third-party ICT provider risk

• ICT provider registry
• Risk assessment before contracting
• Mandatory contractual provisions
• Exit strategy

5. Information sharing

• Participation in information sharing mechanisms
• Notification of authorities about threats

What must financial entities do?

In relation to DNSC (NIS2):

1. Mandatory registration - Even if you're regulated by DORA
2. Provide information for the national risk map
3. Cooperate in case of incidents with cross-sectoral impact

In relation to ASF/BNR (DORA):

1. Implement complete DORA requirements
2. Report incidents to the financial authority
3. Resilience testing according to DORA methodology
4. Provider management according to DORA registry

Critical ICT providers - EU supervision

A unique aspect of DORA: critical ICT service providers for the financial sector will be supervised directly at European level.

Who is considered a critical provider:

• Providers designated by European Supervisory Authorities
• Those providing services to a large number of financial entities
• Those for which no viable alternatives exist

Implications:

• Audits and inspections from EU level
• Direct sanctions for non-compliance
• Specific reporting requirements

Recommendations for financial entities

1. Don't completely ignore NIS2

Even though DORA is the main framework, registration with DNSC remains mandatory. Use NIS2 Manager to understand your classification.

2. Coordinate compliance efforts

• Many requirements overlap (e.g., incident management)
• Use the same processes and documentation where possible
• Avoid duplication of efforts

3. Watch for DORA deadlines

• DORA applies from January 17, 2025
• Some requirements have transition periods
• TLPT testing has specific gradual implementation requirements

4. Manage providers proactively

• If you're an ICT provider for financial entities, prepare
• The DORA registry will increase transparency
• Contractual requirements will be stricter

Conclusion

For the financial sector, DORA is the main compliance framework for cybersecurity, but NIS2 remains relevant for registration and cooperation. An integrated approach covering both frameworks will ensure complete compliance and optimize resources.

Financial entities should work with legal and compliance teams to understand exactly which obligations apply in their specific situation.

Check your NIS2 classification

NIS2 Manager is a product by BetterQA, one of Europe's top software testing companies.