DORA vs. NIS2: Differences, overlaps and requirements

What is the difference between DORA and NIS2?

The main difference lies in scope and legal precedence: NIS2 is an EU directive for cybersecurity in 18 critical and important sectors, from energy and healthcare to digital services. DORA is an EU regulation that applies exclusively to the financial sector and its ICT service providers. For financial entities, DORA is the more specific law and takes precedence over the cybersecurity requirements of NIS2.

With the Digital Operational Resilience Act (DORA) (Regulation (EU) 2022/2554) and the NIS2 Directive (Directive (EU) 2022/2555), the EU has significantly tightened its digital security requirements. DORA has applied directly since 17 January 2025. NIS2 had to be transposed into national law – in Germany through the NIS2 Implementation Act, which entered into force on 6 December 2025 and revises the BSI Act.

Compliance officers, CISOs and management therefore face three questions: Does DORA, NIS2 or both apply to our company? Where do the requirements overlap? And which framework is stricter?

Which takes precedence: DORA or NIS2?

The relationship between DORA and NIS2 follows the principle lex specialis derogat legi generali: the more specific law takes precedence over the general one.

• NIS2 is the general framework: It sets minimum cybersecurity standards across many sectors, from energy and transport to chemicals and postal services.
• DORA is the specific law: Art. 1(2) DORA in conjunction with Art. 4 NIS2 makes clear that DORA applies to financial entities as a sector-specific legal act.

What this means for financial entities: Banks, insurers, payment institutions and FinTechs primarily implement DORA. The NIS2 requirements on risk management and reporting are superseded by DORA for them. The German BSI Act therefore exempts DORA entities from the corresponding obligations.

DORA and NIS2 compared

The table shows the most important differences between the two frameworks:

Which companies fall under which framework?

Three groups help with classification:

1. Financial entities subject to DORA

All entities under Art. 2 DORA, such as credit institutions, investment firms, payment and e-money institutions, crypto-asset service providers (CASPs), fund managers and insurance and reinsurance undertakings. Find out more in our article Who is required to comply with DORA?

2. Companies subject to NIS2

Companies from the 18 NIS2 sectors outside the financial industry that meet the thresholds: generally at least 50 employees or more than €10 million in annual turnover and balance sheet total. Examples include mechanical engineering firms, food producers, municipal utilities, chemical companies and postal services.

3. Special case: ICT service providers and groups

A software or cloud provider that serves banks as well as hospitals or energy suppliers operates at the intersection:

• Towards financial customers, it must meet the contractual requirements under Art. 30 DORA, such as audit rights, service levels and exit arrangements.
• For its own organisation, it may itself fall under NIS2, for example as a cloud provider or managed service provider, provided it meets the thresholds.

Where do DORA and NIS2 overlap?

DORA is more detailed, but both frameworks are based on the same principles. In practice, both require a functioning information security management system (ISMS). The most important overlaps:

1. Management responsibility: DORA (Art. 5) and NIS2 (Art. 20) hold management directly accountable. It must approve security measures, oversee their implementation and undergo regular training. Find out more in our article on management liability under NIS2.
2. Supply chain security: Both frameworks require companies to systematically assess and contractually secure the risks posed by service providers and software suppliers.
3. Incident reporting: Both provide for multi-stage reporting procedures to the competent authority.
4. Business continuity: Crisis management, backups and recovery plans are mandatory under both frameworks.

Can DORA and NIS2 be implemented together?

Yes. If your company or group is affected by both frameworks, you should not build two separate programmes. A joint ISMS – for example based on ISO 27001 or BSI IT-Grundschutz – covers a large part of the requirements of both.

Here’s how to proceed:

1. Create a common foundation: Build policies, risk management, asset management and contingency plans once for the whole organisation.
2. Add specific modules: for the financial business, the DORA register of information, DORA reporting deadlines and contract content under Art. 30; for NIS2, registration and reporting to the BSI.
3. Manage service providers uniformly: Central vendor risk management meets the supply chain requirements of both frameworks.

Which framework is stricter?

Overall, DORA is significantly more detailed and stricter than NIS2.

• DORA requires shorter reporting deadlines (initial notification within 4 hours of classification), detailed contract content for ICT service providers (Art. 30), a register of information and, for selected entities, threat-led penetration testing under the TIBER-EU framework. Compliance is checked by the financial supervisor.
• NIS2 gives member states more leeway in implementation and relies more on general risk management principles.

Conclusion: clear responsibilities, common foundation

The comparison shows: financial entities focus primarily on DORA, all other companies in the 18 sectors on NIS2. ICT service providers and cross-sector groups may be affected by both. For them, a joint ISMS with specific modules for DORA and NIS2 pays off.

With heyData, you implement NIS2 and DORA on a common foundation: with ready-made policies, guided risk analysis and structured service provider management.

Take the first step: Book a free demo now