This comparison helps decide when NIS2 remains the horizontal cyber-security workstream and when DORA takes over cyber risk-management, incident-reporting, testing, information-sharing, and ICT third-party duties for covered financial entities.
Based on the NIS2 Directive, DORA, the Commission NIS2 FAQ, and the Commission Article 4 guidelines. Apply the boundary to each legal entity and each corresponding duty.
For financial entities covered by Regulation (EU) 2022/2554 (DORA), DORA is the under NIS2 Article 4. Its ICT risk-management, incident, testing, information-sharing, third-party-risk, supervision, and enforcement rules apply instead of the corresponding NIS2 entity duties. Apply the boundary entity by entity and duty by duty; NIS2 still governs uncovered entities and the wider national and EU cooperation architecture.
Side-by-side comparison
NIS2 vs DORA: what changes for scope, duties, and evidence
Use the rows to separate active NIS2 duties from DORA-displaced financial-entity duties and the cooperation paths that still connect both regimes.
Horizontal EU cybersecurity directive for essential and important entities, with Article 21 risk-management measures, Article 23 incident reporting, management-body duties, registration, and national supervision.
Second framework
DORA
for covered financial entities where the NIS2 sources say DORA applies instead for named ICT risk, incident, testing, information-sharing, and ICT third-party duties.
NIS2 vs DORA: what changes for scope, duties, and evidence
Essential and important entities in NIS2 Annex I and Annex II sectors, subject to size-cap and special inclusion rules, unless a displaces the relevant NIS2 duty.
Start with entity type and duty type. The same corporate group can need a DORA handoff for one financial-entity ICT duty and NIS2 analysis for another entity, service, or sector.
Management bodies of essential and important entities approve and oversee Article 21 measures; security, incident-response, supplier-risk, legal, and country teams maintain the operating evidence.
Financial-entity ICT risk, resilience, incident, procurement, outsourcing, and regulatory-reporting owners handle the DORA-displaced topics, with DORA authorities connected to NIS2 cooperation channels.
NIS2 is triggered by covered sector, entity category, size or special-case inclusion, jurisdiction, and the presence of Article 21 or Article 23 duties not displaced by another act.
The DORA handoff is triggered when the entity is a covered financial entity and the duty falls into the DORA areas listed by the NIS2 Article 4 guidance.
Article 21 cybersecurity risk-management measures, Article 23 significant-incident notifications, management-body accountability and training, supplier-risk controls, and registration or jurisdiction records where applicable.
For covered financial entities, DORA applies instead for ICT risk management, ICT-related incidents and major ICT incident reporting, resilience testing, information-sharing arrangements, and ICT third-party risk.
NIS2 evidence includes scope analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, incident logs, notification records, and national registration details.
For DORA overlap in this NIS2-official source page, evidence should prove the handoff: covered financial-entity status, the DORA topic involved, the source citation, and the authority/reporting route.
NIS2 timing includes Member State transposition and registration processes plus the Article 23 sequence: early warning within 24 hours, incident notification within 72 hours, and later reporting steps.
For DORA-covered topics, use the DORA workstream timeline and keep NIS2-side coordination visible where incident or threat details must reach CSIRTs, competent authorities, or SPOCs.
Calendar the earliest active reporting clock and add reassessment triggers for entity changes, new financial services, supplier changes, cross-border services, and incident escalation.
NIS2 supervision and enforcement run through national competent authorities, with differentiated treatment for essential and important entities and administrative fines for Article 21 or Article 23 infringements.
For DORA-displaced financial-entity duties, the NIS2 sources point to financial-sector supervisory authorities and cooperation with NIS2 competent authorities, CSIRTs, SPOCs, and the Cooperation Group.
NIS2 continues to provide the horizontal cyber framework and cooperation architecture, including CSIRTs, SPOCs, Cooperation Group participation, and national cyber strategies.
DORA takes the sector-specific role for covered financial entities on the listed ICT topics, but the NIS2 sources keep information exchange with NIS2 bodies in scope.
Use the DORA handoff when the entity is a covered financial entity and the duty is one of the DORA ICT risk, incident, testing, information-sharing, or ICT third-party topics identified in the NIS2 sources.
The output should be a concise scope note: entity, duty, active regime, displaced regime if any, evidence owner, reporting route, and reassessment trigger.
Essential and important entities in NIS2 Annex I and Annex II sectors, subject to size-cap and special inclusion rules, unless a displaces the relevant NIS2 duty.
Start with entity type and duty type. The same corporate group can need a DORA handoff for one financial-entity ICT duty and NIS2 analysis for another entity, service, or sector.
Management bodies of essential and important entities approve and oversee Article 21 measures; security, incident-response, supplier-risk, legal, and country teams maintain the operating evidence.
Financial-entity ICT risk, resilience, incident, procurement, outsourcing, and regulatory-reporting owners handle the DORA-displaced topics, with DORA authorities connected to NIS2 cooperation channels.
NIS2 is triggered by covered sector, entity category, size or special-case inclusion, jurisdiction, and the presence of Article 21 or Article 23 duties not displaced by another act.
The DORA handoff is triggered when the entity is a covered financial entity and the duty falls into the DORA areas listed by the NIS2 Article 4 guidance.
Article 21 cybersecurity risk-management measures, Article 23 significant-incident notifications, management-body accountability and training, supplier-risk controls, and registration or jurisdiction records where applicable.
For covered financial entities, DORA applies instead for ICT risk management, ICT-related incidents and major ICT incident reporting, resilience testing, information-sharing arrangements, and ICT third-party risk.
NIS2 evidence includes scope analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, incident logs, notification records, and national registration details.
For DORA overlap in this NIS2-official source page, evidence should prove the handoff: covered financial-entity status, the DORA topic involved, the source citation, and the authority/reporting route.
NIS2 timing includes Member State transposition and registration processes plus the Article 23 sequence: early warning within 24 hours, incident notification within 72 hours, and later reporting steps.
For DORA-covered topics, use the DORA workstream timeline and keep NIS2-side coordination visible where incident or threat details must reach CSIRTs, competent authorities, or SPOCs.
Calendar the earliest active reporting clock and add reassessment triggers for entity changes, new financial services, supplier changes, cross-border services, and incident escalation.
NIS2 supervision and enforcement run through national competent authorities, with differentiated treatment for essential and important entities and administrative fines for Article 21 or Article 23 infringements.
For DORA-displaced financial-entity duties, the NIS2 sources point to financial-sector supervisory authorities and cooperation with NIS2 competent authorities, CSIRTs, SPOCs, and the Cooperation Group.
NIS2 continues to provide the horizontal cyber framework and cooperation architecture, including CSIRTs, SPOCs, Cooperation Group participation, and national cyber strategies.
DORA takes the sector-specific role for covered financial entities on the listed ICT topics, but the NIS2 sources keep information exchange with NIS2 bodies in scope.
Use the DORA handoff when the entity is a covered financial entity and the duty is one of the DORA ICT risk, incident, testing, information-sharing, or ICT third-party topics identified in the NIS2 sources.
The output should be a concise scope note: entity, duty, active regime, displaced regime if any, evidence owner, reporting route, and reassessment trigger.
How should teams decide whether NIS2 or DORA controls a cyber-compliance duty?
Identify the legal entity, financial-entity status, NIS2 sector or subsector, Member State jurisdiction, and concrete cyber duty.
Check whether the duty falls into the DORA areas that the NIS2 Article 4 guidance treats as sector-specific for covered financial entities.
If DORA displaces the NIS2 duty, document the DORA handoff and preserve any NIS2 cooperation, CSIRT, SPOC, or national-strategy information-sharing step.
If DORA does not cover the entity or duty, run the NIS2 scope, Article 21, Article 23, management-body, and supervision analysis as its own workstream.
For financial entities covered by DORA, DORA is the for NIS2 Article 4. Its ICT risk management, ICT-related incident management and major-incident reporting, resilience testing, information-sharing arrangements, and ICT third-party-risk provisions apply instead of the corresponding NIS2 provisions. This is not a blanket exemption for an entire corporate group or every service it provides.
That does not remove the financial sector from the NIS2 ecosystem. The same NIS2 recital and Commission FAQ keep information exchange with NIS2 bodies in view: DORA authorities can participate in the NIS Cooperation Group, cooperate with single points of contact and CSIRTs, and pass major ICT-related incident details or significant cyber-threat information into the NIS2 channels.
DORA has applied since 17 January 2025. Its Article 2 list includes, subject to definitions and exclusions, credit and payment institutions, electronic-money institutions, investment firms, crypto-asset service providers, central securities depositories, central counterparties, trading venues, trade repositories, fund managers, insurance and reinsurance actors, institutions for occupational retirement provision, credit-rating agencies, crowdfunding providers, securitisation repositories, and ICT third-party service providers. A group label such as bank, insurer, or fintech is not enough; match each legal entity to the Article 2 category and exclusion.
Use DORA as the controlling workstream for covered financial entities on the DORA-listed ICT risk, incident, testing, information-sharing, and ICT third-party topics.
Use NIS2 for entities, sectors, or duties not displaced by a and for NIS2 cooperation architecture that still receives financial-sector incident or threat information.
Keep a written scope note showing which entity is covered, which obligation is displaced, and which authority or reporting route owns the next action.
NIS2 remains the horizontal cybersecurity framework for essential and important entities unless a displaces the relevant requirements. For a DORA-covered financial entity, Commission guidance says the linked NIS2 Article 20 management-body duties and the Article 3 list and Article 27 registration provisions should not apply where the DORA sector-specific rule covers the underlying risk-management requirements. NIS2 national strategies, crisis-management structures, cooperation, and information exchange continue to matter.
For implementation teams, the useful first split is entity-and-duty specific. A banking or trading-venue fact pattern may point to DORA for ICT risk and major ICT incident reporting, while a non-financial digital infrastructure provider, managed service provider, public administration entity, or manufacturer in NIS2 scope may remain on the NIS2 workstream.
Identify the NIS2 sector or subsector, entity category, and Member State jurisdiction before assigning controls.
Do not assign NIS2 Article 20, Article 21, or Article 23 to a DORA-covered financial entity for a displaced duty; record the DORA governance and reporting owner instead.
Track 24-hour early warning, 72-hour incident notification, and final-report evidence where NIS2 Article 23 controls the incident sequence.
Where DORA replaces NIS2 duties for financial entities
The NIS2 Article 4 guidelines name the DORA areas that replace the equivalent NIS2 duties for covered financial entities: ICT risk management, ICT-related incident management and major ICT-related incident reporting, digital operational resilience testing, information-sharing arrangements, and ICT third-party risk. The guidance also identifies examples of overlapping financial entities, including credit institutions, trading venues, and central counterparties.
DORA supplies the active legal requirements for those displaced topics. Use its Article 2 entity list and exclusions, governance and ICT risk-management framework, major ICT-related incident classification and reporting rules, testing programme, information-sharing conditions, and ICT third-party-risk chapter. Regulatory and implementing technical standards add operational detail, so verify the current reporting templates and authority instructions rather than importing NIS2's 24-hour and 72-hour sequence.
Record the DORA-covered financial-entity type and the specific DORA topic that replaces the NIS2 duty.
Do not cite NIS2 Article 21 or Article 23 as the active duty for the same covered financial-entity topic when the Article 4/DORA rule applies.
Keep CSIRT, SPOC, and competent-authority information-sharing paths visible even when the primary reporting obligation sits in DORA.
Evidence to keep when both regimes are in the conversation
A useful comparison file should show the scoping conclusion, the source that supports it, the owner for the active workstream, and the evidence location. For NIS2 this may include sector classification, size-cap analysis, management-body approval and training records, Article 21 control evidence, supplier-risk files, and Article 23 incident records. For DORA overlap, keep the evidence at the handoff level unless DORA-specific sources are available.
Do not merge the regimes into one generic cybersecurity checklist. Shared inventories, supplier files, incident logs, and management approvals can be reused, but each evidence item should state whether it supports an active NIS2 duty, a DORA-displaced duty, or an information-sharing/cooperation step between the regimes.
Label each evidence item by regime, article or source, owner, and review trigger.
Add a short 'DORA replaces NIS2 for this duty' note when relying on the rule.
Escalate to legal or regulatory counsel when the entity is partly in financial services and partly in another NIS2 sector.
This comparison helps separate active duties from handoff points
Sorena can help turn the NIS2/DORA split into cited scope notes, evidence requests, and owner assignments without treating the two regimes as one generic cybersecurity checklist.
Binding NIS2 text for scope, management-body accountability, Article 21 cybersecurity risk-management measures, Article 23 incident reporting, supervision, and the DORA sector-specific rule.
"high common level of cybersecurity across the Union"
Commission implementing regulation setting technical and methodological requirements for selected NIS2 digital infrastructure and ICT service management entities.