NIS2 vs DORA: which one applies to you?

If you are a bank, insurer, investment firm, payment institution or another regulated financial entity, DORA is your rulebook for ICT risk, incident reporting, resilience testing and supplier risk. Almost everyone else in a critical sector who meets the size threshold falls under NIS2. A smaller group sits under both, usually because they supply ICT services to financial firms.

That is the short answer. The rest of this article turns it into a decision you can make for your own organisation, and explains what changes depending on where you land.

What is the difference between NIS2 and DORA?

NIS2 is a cross-sector cybersecurity directive covering 18 critical sectors, from energy and health to digital infrastructure and manufacturing. DORA is a regulation written only for the financial sector and its ICT suppliers. Where both could apply to a financial entity, DORA takes precedence for ICT risk management, incident reporting and testing.

The practical differences come down to five things:

• Legal form. NIS2 is a directive, so each country writes it into national law and details vary between countries. DORA is a regulation, so the text is the same everywhere it applies.
• Who it covers. NIS2 covers medium and large organisations in 18 sectors, split into essential and important entities. DORA covers about twenty types of financial entity, plus the ICT third-party providers that serve them.
• Who supervises. Under NIS2, a national cybersecurity authority and its CSIRT. Under DORA, the financial supervisor.
• How deep it goes. NIS2 sets a baseline of ten risk-management measures. DORA is far more prescriptive, with detailed technical standards on ICT risk, incident classification, testing and contracts.
• How suppliers are treated. Both require you to manage supply chain risk. DORA goes further, with a register of every ICT contract, mandatory contract clauses, exit strategies and direct EU oversight of critical ICT providers.

Which one applies to my organisation?

Work through these four questions in order. Stop at the first one that is a yes.

1. Are you a financial entity listed in DORA? That includes credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, insurers and reinsurers, occupational pension funds and fund managers, among others. If yes, DORA applies to you. NIS2 only fills the gaps DORA does not cover.
2. Do you operate in an NIS2 sector and have 50 or more employees, or both annual turnover and balance sheet above EUR 10 million? The sectors include energy, transport, health, drinking water, digital infrastructure, ICT service management, public administration, space, postal services, waste, chemicals, food, manufacturing, digital providers and research. If yes, NIS2 applies.
3. Do you provide ICT services to financial entities? Managed IT, hosting, cloud and managed security providers are usually NIS2 entities in their own right. Their financial customers are also obliged under DORA to push specific clauses, audit rights and testing into their contracts. In practice you work to both.
4. None of the above? Neither applies to you directly. That rarely means you are untouched: regulated customers will pass their requirements down to you through procurement questionnaires and contracts.

Some organisations fall under NIS2 regardless of size, for example the sole provider of a critical service in a country, DNS and top-level domain registries, and certain public bodies. If you are close to any of these lines, confirm your scope before you plan anything else.

If DORA applies to us, can we ignore NIS2?

Mostly, but not entirely. DORA replaces NIS2's risk-management and incident-reporting duties for financial entities, because it is the more specific law. Some NIS2 elements can still reach you through national law, such as registration with the national authority or information sharing with the national CSIRT.

The bigger exposure is usually your group structure. A financial group with a non-financial subsidiary, such as an energy or IT services company, can have one entity under DORA and another under NIS2. Each entity needs its own scoping.

How do NIS2 and DORA incident reporting deadlines differ?

Both use a three-stage report, but the clocks start differently. NIS2 starts the clock when you become aware of a significant incident. DORA starts it when you classify an ICT incident as major, which must happen quickly. DORA's first deadline is also much shorter.

NIS2, significant incidents, to the national CSIRT or competent authority:

• Early warning within 24 hours of becoming aware.
• Incident notification within 72 hours.
• Final report within one month of the incident notification.

DORA, major ICT-related incidents, to the financial supervisor:

• Initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it.
• Intermediate report within 72 hours of the initial notification.
• Final report within one month of the latest intermediate report.

If your incident response plan was written for NIS2 timelines, it is not ready for DORA. The 4-hour window only works if classification criteria, decision owners and reporting templates are agreed before the incident, not during it.

Does NIS2 or DORA require penetration testing?

DORA does, explicitly. NIS2 does not name penetration testing, but it requires you to assess whether your security measures actually work, and testing is the most common way to prove that.

Under DORA, every in-scope financial entity must run a digital operational resilience testing programme, with critical systems tested at least once a year. Methods include vulnerability assessments, scenario-based tests and penetration tests. Larger and systemically important entities, designated by their supervisor, must also run threat-led penetration testing (TLPT) at least every three years. TLPT is a red-team exercise against live production systems, based on current threat intelligence and run in line with the TIBER-EU framework.

Under NIS2, Article 21 requires policies and procedures to assess the effectiveness of your cybersecurity risk-management measures. Regulators will ask how you know your controls work. A recent penetration test or red-team exercise, with findings tracked to closure, is the clearest answer you can give.

Who is accountable, the board or the security team?

Under both, the board. NIS2 requires management bodies to approve and oversee cybersecurity measures, makes them liable for failures, and requires them to take training. DORA gives the management body ultimate responsibility for ICT risk, including approving the strategy and budget. Neither lets leadership delegate accountability to IT.

This is the change most organisations underestimate. It means the board needs enough understanding to challenge what it is approving, which is why NIS2 and DORA training for executives is often the first engagement, not the last.

Can one programme cover both NIS2 and DORA?

Yes, and for most organisations it should. Both regimes ask for the same foundations: governance, risk assessment, asset management, supplier control, incident response, continuity and testing. An ISO 27001 management system covers much of that ground, so build the controls once and map them to each framework.

What does not transfer automatically is the detail. DORA's register of ICT contracts, its incident classification criteria and its testing programme have no direct NIS2 equivalent, so plan for those as additions on top of a shared base. Our regulatory readiness work is built around exactly this: one scoping, one roadmap, mapped to every framework that applies.

When do NIS2 and DORA apply in Iceland?

DORA applies in Iceland from 1 January 2026, under Act no. 78/2025 on digital operational resilience of the financial market. It is supervised by the Financial Supervisory Authority of the Central Bank of Iceland. NIS2 has not yet been enacted in Icelandic law, so Act no. 78/2019 on network and information security still applies.

Iceland takes EU rules into national law through the EEA Agreement, which is why the dates differ from the EU's. DORA has applied in EU member states since 17 January 2025, and member states were due to transpose NIS2 by 17 October 2024. Organisations with operations or customers in EU countries such as Sweden may already be in scope there, regardless of the Icelandic timetable.

The current Icelandic law covers a much narrower group of operators of essential services. NIS2 will reach many more organisations, including medium-sized companies in sectors that have never been regulated for cybersecurity. Building the controls takes most organisations a year or more, so starting now means you meet the law with evidence in hand, not a plan.

Where should you start?

Start by confirming scope, for every legal entity in your group. Then measure the gap between what you do today and what the regulation expects. The roadmap follows from the gap, not the other way round.

• Check where you stand on NIS2 with our free NIS2 readiness check, a short self-assessment followed by guidance from a senior Syndis advisor.
• Get a structured gap assessment for NIS2 or across several frameworks at once through regulatory readiness.
• Prepare your leadership with NIS2 and DORA training for boards, compliance owners and security teams.

Not sure which regime applies to you? Talk to a Syndis advisor and we will help you scope it.