NIS2 vs DORA where EU cyber duties split

Essential and important entities in NIS2 Annex I and Annex II sectors, subject to size-cap and special inclusion rules, unless a sector-specific Union act displaces the relevant NIS2 duty.

Covered financial entities where DORA is the sector-specific Union act for the cybersecurity topics named in the NIS2 recital and Article 4 guidance.

Start with entity type and duty type. The same corporate group can need a DORA handoff for one financial-entity ICT duty and NIS2 analysis for another entity, service, or sector.

Management bodies of essential and important entities approve and oversee Article 21 measures; security, incident-response, supplier-risk, legal, and country teams maintain the operating evidence.

Financial-entity ICT risk, resilience, incident, procurement, outsourcing, and regulatory-reporting owners handle the DORA-displaced topics, with DORA authorities connected to NIS2 cooperation channels.

Assign one owner for the active legal workstream and one owner for information-sharing or CSIRT/SPOC coordination when the regimes meet.

NIS2 is triggered by covered sector, entity category, size or special-case inclusion, jurisdiction, and the presence of Article 21 or Article 23 duties not displaced by another act.

The DORA handoff is triggered when the entity is a covered financial entity and the duty falls into the DORA areas listed by the NIS2 Article 4 guidance.

Do not decide from the acronym alone. Write the entity, service, jurisdiction, and specific duty before choosing NIS2, DORA, or both for coordination.

Article 21 cybersecurity risk-management measures, Article 23 significant-incident notifications, management-body accountability and training, supplier-risk controls, and registration or jurisdiction records where applicable.

For covered financial entities, DORA applies instead for ICT risk management, ICT-related incidents and major ICT incident reporting, resilience testing, information-sharing arrangements, and ICT third-party risk.

Turn each active duty into an owner, source citation, evidence file, and reporting path; avoid a combined checklist that hides which regime controls.

NIS2 evidence includes scope analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, incident logs, notification records, and national registration details.

For DORA overlap in this NIS2-grounded page, evidence should prove the handoff: covered financial-entity status, the DORA topic involved, the source citation, and the authority/reporting route.

Shared inventories, contracts, tests, and incident logs can be reused only if each item is labelled with the regime and duty it supports.

NIS2 timing includes Member State transposition and registration processes plus the Article 23 sequence: early warning within 24 hours, incident notification within 72 hours, and later reporting steps.

For DORA-covered topics, use the DORA workstream timeline and keep NIS2-side coordination visible where incident or threat details must reach CSIRTs, competent authorities, or SPOCs.

Calendar the earliest active reporting clock and add reassessment triggers for entity changes, new financial services, supplier changes, cross-border services, and incident escalation.

NIS2 supervision and enforcement run through national competent authorities, with differentiated treatment for essential and important entities and administrative fines for Article 21 or Article 23 infringements.

For DORA-displaced financial-entity duties, the NIS2 sources point to financial-sector supervisory authorities and cooperation with NIS2 competent authorities, CSIRTs, SPOCs, and the Cooperation Group.

Escalate to the authority path that owns the active duty, while preserving NIS2 information-sharing records where the regimes require cooperation.

NIS2 continues to provide the horizontal cyber framework and cooperation architecture, including CSIRTs, SPOCs, Cooperation Group participation, and national cyber strategies.

DORA takes the sector-specific role for covered financial entities on the listed ICT topics, but the NIS2 sources keep information exchange with NIS2 bodies in scope.

Reuse evidence at the control level, not at the legal conclusion level. A reused log or supplier file still needs a source-linked label for each regime.

Use NIS2 when the entity and duty remain within the NIS2 scope and are not displaced by a sector-specific Union act with equivalent cyber requirements.

Use the DORA handoff when the entity is a covered financial entity and the duty is one of the DORA ICT risk, incident, testing, information-sharing, or ICT third-party topics identified in the NIS2 sources.

The output should be a concise scope note: entity, duty, active regime, displaced regime if any, evidence owner, reporting route, and reassessment trigger.