This comparison helps decide when NIS2 remains the horizontal cyber-security workstream and when DORA takes over cyber risk-management, incident-reporting, testing, information-sharing, and ICT third-party duties for covered financial entities.
DORA is the Digital Operational Resilience Act, Regulation (EU) 2022/2554 for the financial sector. Apply the boundary between DORA and NIS2 to each legal entity and each corresponding duty.
For financial entities covered by Regulation (EU) 2022/2554 (DORA), DORA is the under NIS2 Article 4. Its ICT risk-management, incident, testing, information-sharing, third-party-risk, supervision, and enforcement rules apply instead of the corresponding NIS2 entity duties. Apply the boundary entity by entity and duty by duty; NIS2 still governs uncovered entities and the wider national and EU cooperation architecture.
Side-by-side comparison
NIS2 vs DORA: what changes for scope, duties, and evidence
Use the rows to separate active NIS2 duties from DORA-displaced financial-entity duties and the cooperation paths that still connect both regimes.
Horizontal EU cybersecurity directive for essential and important entities, with Article 21 risk-management measures, Article 23 incident reporting, management-body duties, registration, and national supervision.
Second framework
DORA
for covered financial entities, with ICT risk management, incident reporting, resilience testing, information sharing, and ICT third-party-risk duties.
NIS2 vs DORA: what changes for scope, duties, and evidence
Essential and important entities in NIS2 Annex I and Annex II sectors, subject to size-cap and special inclusion rules, unless a displaces the relevant NIS2 duty.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Covered financial entities where DORA is the for the cybersecurity topics named in the NIS2 recital and Article 4 guidance.
Commission guidance explaining when DORA is the sector-specific Union act for financial entities that are also within NIS2 scope.
sector-specific Union legal act
Start with entity type and duty type. The same corporate group can need a DORA handoff for one financial-entity ICT duty and NIS2 analysis for another entity, service, or sector.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Management bodies of essential and important entities approve and oversee Article 21 measures; security, incident-response, supplier-risk, legal, and country teams maintain the operating evidence.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Financial-entity ICT risk, resilience, incident, procurement, outsourcing, and regulatory-reporting owners handle the DORA-displaced topics, with DORA authorities connected to NIS2 cooperation channels.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
NIS2 is triggered by covered sector, entity category, size or special-case inclusion, jurisdiction, and the presence of Article 21 or Article 23 duties not displaced by another act.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
The DORA handoff is triggered when the entity is a covered financial entity and the duty falls into the DORA areas listed by the NIS2 Article 4 guidance.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Article 21 cybersecurity risk-management measures, Article 23 significant-incident notifications, management-body accountability and training, supplier-risk controls, and registration or jurisdiction records where applicable.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
For covered financial entities, DORA applies instead for ICT risk management, ICT-related incidents and major ICT incident reporting, resilience testing, information-sharing arrangements, and ICT third-party risk.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
NIS2 evidence includes scope analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, incident logs, notification records, and national registration details.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
For DORA-covered financial entities, keep the scope conclusion, active DORA requirements, owner, evidence references, and authority or reporting route. Retain the Article 4 analysis explaining which corresponding NIS2 provisions are displaced.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
NIS2 timing includes Member State transposition and registration processes plus Article 23 reports without undue delay: early warning within 24 hours of awareness, incident notification generally within 72 hours, and later reports. Trust service providers have a 24-hour incident-notification limit for significant incidents affecting trust services.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
For DORA-covered topics, use the DORA workstream timeline and keep NIS2-side coordination visible where incident or threat details must reach CSIRTs, competent authorities, or SPOCs.
Commission guidance explaining when DORA is the sector-specific Union act for financial entities that are also within NIS2 scope.
sector-specific Union legal act
Calendar the earliest active reporting clock and add reassessment triggers for entity changes, new financial services, supplier changes, cross-border services, and incident escalation.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
NIS2 supervision and enforcement run through national competent authorities, with differentiated treatment for essential and important entities and administrative fines for Article 21 or Article 23 infringements.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
For DORA-displaced financial-entity duties, the NIS2 sources point to financial-sector supervisory authorities and cooperation with NIS2 competent authorities, CSIRTs, SPOCs, and the Cooperation Group.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
NIS2 continues to provide the horizontal cyber framework and cooperation architecture, including CSIRTs, SPOCs, Cooperation Group participation, and national cyber strategies.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA takes the sector-specific role for covered financial entities on the listed ICT topics, but the NIS2 sources keep information exchange with NIS2 bodies in scope.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Use the DORA handoff when the entity is a covered financial entity and the duty is one of the DORA ICT risk, incident, testing, information-sharing, or ICT third-party topics identified in the NIS2 sources.
Commission guidance explaining when DORA is the sector-specific Union act for financial entities that are also within NIS2 scope.
sector-specific Union legal act
The output should be a concise scope note: entity, duty, active regime, displaced regime if any, evidence owner, reporting route, and reassessment trigger.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Scope and covered activity
NIS2
Essential and important entities in NIS2 Annex I and Annex II sectors, subject to size-cap and special inclusion rules, unless a displaces the relevant NIS2 duty.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
Covered financial entities where DORA is the for the cybersecurity topics named in the NIS2 recital and Article 4 guidance.
Commission guidance explaining when DORA is the sector-specific Union act for financial entities that are also within NIS2 scope.
sector-specific Union legal act
Operational implication
Start with entity type and duty type. The same corporate group can need a DORA handoff for one financial-entity ICT duty and NIS2 analysis for another entity, service, or sector.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Who must act
NIS2
Management bodies of essential and important entities approve and oversee Article 21 measures; security, incident-response, supplier-risk, legal, and country teams maintain the operating evidence.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
Financial-entity ICT risk, resilience, incident, procurement, outsourcing, and regulatory-reporting owners handle the DORA-displaced topics, with DORA authorities connected to NIS2 cooperation channels.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Trigger or threshold
NIS2
NIS2 is triggered by covered sector, entity category, size or special-case inclusion, jurisdiction, and the presence of Article 21 or Article 23 duties not displaced by another act.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
The DORA handoff is triggered when the entity is a covered financial entity and the duty falls into the DORA areas listed by the NIS2 Article 4 guidance.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Core obligations
NIS2
Article 21 cybersecurity risk-management measures, Article 23 significant-incident notifications, management-body accountability and training, supplier-risk controls, and registration or jurisdiction records where applicable.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
For covered financial entities, DORA applies instead for ICT risk management, ICT-related incidents and major ICT incident reporting, resilience testing, information-sharing arrangements, and ICT third-party risk.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Evidence and records
NIS2
NIS2 evidence includes scope analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, incident logs, notification records, and national registration details.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
For DORA-covered financial entities, keep the scope conclusion, active DORA requirements, owner, evidence references, and authority or reporting route. Retain the Article 4 analysis explaining which corresponding NIS2 provisions are displaced.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Timing and cadence
NIS2
NIS2 timing includes Member State transposition and registration processes plus Article 23 reports without undue delay: early warning within 24 hours of awareness, incident notification generally within 72 hours, and later reports. Trust service providers have a 24-hour incident-notification limit for significant incidents affecting trust services.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
For DORA-covered topics, use the DORA workstream timeline and keep NIS2-side coordination visible where incident or threat details must reach CSIRTs, competent authorities, or SPOCs.
Commission guidance explaining when DORA is the sector-specific Union act for financial entities that are also within NIS2 scope.
sector-specific Union legal act
Operational implication
Calendar the earliest active reporting clock and add reassessment triggers for entity changes, new financial services, supplier changes, cross-border services, and incident escalation.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Enforcement or assurance route
NIS2
NIS2 supervision and enforcement run through national competent authorities, with differentiated treatment for essential and important entities and administrative fines for Article 21 or Article 23 infringements.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
For DORA-displaced financial-entity duties, the NIS2 sources point to financial-sector supervisory authorities and cooperation with NIS2 competent authorities, CSIRTs, SPOCs, and the Cooperation Group.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Overlap and reuse
NIS2
NIS2 continues to provide the horizontal cyber framework and cooperation architecture, including CSIRTs, SPOCs, Cooperation Group participation, and national cyber strategies.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
DORA takes the sector-specific role for covered financial entities on the listed ICT topics, but the NIS2 sources keep information exchange with NIS2 bodies in scope.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
DORA
Use the DORA handoff when the entity is a covered financial entity and the duty is one of the DORA ICT risk, incident, testing, information-sharing, or ICT third-party topics identified in the NIS2 sources.
Commission guidance explaining when DORA is the sector-specific Union act for financial entities that are also within NIS2 scope.
sector-specific Union legal act
Operational implication
The output should be a concise scope note: entity, duty, active regime, displaced regime if any, evidence owner, reporting route, and reassessment trigger.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
Practical decision rule
How should teams decide whether NIS2 or DORA controls a cyber-compliance duty?
Identify the legal entity, financial-entity status, NIS2 sector or subsector, Member State jurisdiction, and concrete cyber duty.
Check whether the duty falls into the DORA areas that the NIS2 Article 4 guidance treats as sector-specific for covered financial entities.
If DORA displaces the NIS2 duty, document the DORA handoff and preserve any NIS2 cooperation, CSIRT, SPOC, or national-strategy information-sharing step.
If DORA does not cover the entity or duty, run the NIS2 scope, Article 21, Article 23, management-body, and supervision analysis as its own workstream.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
1
Section 1
The short answer for NIS2 and DORA overlap
For financial entities covered by DORA, DORA is the for NIS2 Article 4. Its ICT risk management, ICT-related incident management and major-incident reporting, resilience testing, information-sharing arrangements, and ICT third-party-risk provisions apply instead of the corresponding NIS2 provisions. This is not a blanket exemption for an entire corporate group or every service it provides.
That does not remove the financial sector from the NIS2 ecosystem. The same NIS2 recital and Commission FAQ keep information exchange with NIS2 bodies in view: DORA authorities can participate in the NIS Cooperation Group, cooperate with single points of contact and CSIRTs, and pass major ICT-related incident details or significant cyber-threat information into the NIS2 channels.
DORA has applied since 17 January 2025. Its Article 2 list includes, subject to definitions and exclusions, credit and payment institutions, electronic-money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, fund managers, insurance and reinsurance actors, institutions for occupational retirement provision, credit-rating agencies, crowdfunding providers, securitisation repositories, and ICT third-party service providers. A group label such as bank, insurer, or fintech is not enough; match each legal entity to the Article 2 category and exclusion.
Use DORA as the controlling workstream for covered financial entities on the DORA-listed ICT risk, incident, testing, information-sharing, and ICT third-party topics.
Use NIS2 for entities, sectors, or duties not displaced by a and for NIS2 cooperation architecture that still receives financial-sector incident or threat information.
Keep a written scope note showing which entity is covered, which obligation is displaced, and which authority or reporting route owns the next action.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Binding DORA source for the covered financial-entity categories, exclusions, ICT risk-management framework, incident reporting, resilience testing, ICT third-party risk, and 17 January 2025 application date.
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
2
Section 2
Where NIS2 remains the workstream
NIS2 remains the horizontal cybersecurity framework for essential and important entities unless a displaces the relevant requirements. For a DORA-covered financial entity, Commission guidance says the linked NIS2 Article 20 management-body duties and the Article 3 list and Article 27 registration provisions should not apply where the DORA sector-specific rule covers the underlying risk-management requirements. NIS2 national strategies, crisis-management structures, cooperation, and information exchange continue to matter.
For implementation teams, the useful first split is entity-and-duty specific. A banking or trading-venue fact pattern may point to DORA for ICT risk and major ICT incident reporting, while a non-financial digital infrastructure provider, managed service provider, public administration entity, or manufacturer in NIS2 scope may remain on the NIS2 workstream.
Identify the NIS2 sector or subsector, entity category, and Member State jurisdiction before assigning controls.
Do not assign NIS2 Article 20, Article 21, or Article 23 to a DORA-covered financial entity for a displaced duty; record the DORA governance and reporting owner instead.
Track 24-hour early warning, 72-hour incident notification, and final-report evidence where NIS2 Article 23 controls the incident sequence.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission implementing regulation setting technical and methodological requirements for selected NIS2 digital infrastructure and ICT service management entities.
ENISA guidance with practical evidence examples for the NIS2 implementing regulation; advisory rather than legally binding.
examples of evidence
3
Section 3
Where DORA replaces NIS2 duties for financial entities
The NIS2 Article 4 guidelines name the DORA areas that replace the equivalent NIS2 duties for covered financial entities: ICT risk management, ICT-related incident management and major ICT-related incident reporting, digital operational resilience testing, information-sharing arrangements, and ICT third-party risk. The guidance also identifies examples of overlapping financial entities, including credit institutions, trading venues, and central counterparties.
DORA supplies the active legal requirements for those displaced topics. Use its Article 2 entity list and exclusions, governance and ICT risk-management framework, major ICT-related incident classification and reporting rules, testing programme, information-sharing conditions, and ICT third-party-risk chapter. Regulatory and implementing technical standards add operational detail, so verify the current reporting templates and authority instructions rather than importing NIS2's 24-hour and 72-hour sequence.
Record the DORA-covered financial-entity type and the specific DORA topic that replaces the NIS2 duty.
Do not cite NIS2 Article 21 or Article 23 as the active duty for the same covered financial-entity topic when the Article 4/DORA rule applies.
Keep CSIRT, SPOC, and competent-authority information-sharing paths visible even when the primary reporting obligation sits in DORA.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
Commission FAQ explaining NIS2 cooperation, transposition, jurisdiction, and the interaction between NIS2 and DORA for financial-sector entities.
DORA will apply to these entities
4
Section 4
Evidence to keep when both regimes are in the conversation
A useful comparison file should show the scoping conclusion, the source that supports it, the owner for the active workstream, and the evidence location. For NIS2 this may include sector classification, size-cap analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, and Article 23 incident records. For DORA-covered financial entities, record the active DORA duty, responsible owner, supporting records, and reporting or supervisory route.
Do not merge the regimes into one generic cybersecurity checklist. Shared inventories, supplier files, incident logs, and management approvals can be reused, but each evidence item should state whether it supports an active NIS2 duty, a DORA-displaced duty, or an information-sharing/cooperation step between the regimes.
Label each evidence item by regime, article or source, owner, and review trigger.
Add a short 'DORA replaces NIS2 for this duty' note when relying on the rule.
Escalate to legal or regulatory counsel when the entity is partly in financial services and partly in another NIS2 sector.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
high common level of cybersecurity across the Union
ENISA guidance with practical evidence examples for the NIS2 implementing regulation; advisory rather than legally binding.
examples of evidence
Recommended next step
This comparison helps separate active duties from handoff points
Sorena can help turn the NIS2/DORA split into cited scope notes, evidence requests, and owner assignments without treating the two regimes as one generic cybersecurity checklist.
Binding source for DORA scope, exclusions, ICT risk management, major ICT-related incident reporting, resilience testing, information sharing, ICT third-party risk, supervision, enforcement, and application from 17 January 2025.
Binding DORA source for the covered financial-entity categories, exclusions, ICT risk-management framework, incident reporting, resilience testing, ICT third-party risk, and 17 January 2025 application date.
Binding source for the DORA duties that apply to covered financial entities instead of the corresponding NIS2 duties.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
"high common level of cybersecurity across the Union"
Commission implementing regulation setting technical and methodological requirements for selected NIS2 digital infrastructure and ICT service management entities.