NIS2 & DORA

NIS2 and DORA are two recent European regulations that raise cybersecurity requirements with concrete obligations and penalties. NIS2 covers essential and important sectors; DORA is specific to the financial sector. Both set the EU compliance agenda.

NIS2 (Directive EU 2022/2555)

What     a cybersecurity directive for ESSENTIAL and IMPORTANT entities
Sectors  energy, transport, banking, health, water, digital infrastructure, public admin,
         digital service providers, manufacturing, postal, waste... (expands NIS1)
Key      replaces NIS1 with more sectors, more obligations, and real penalties
Spain    transposed into national law; supervision by competent authorities

NIS2 main obligations

- risk-management measures (art. 21): policies, IR, continuity, supply chain,
  encryption, access control, MFA, training...
- incident NOTIFICATION of significant incidents: early warning in 24h, notification in 72h,
  final report in 1 month
- management ACCOUNTABILITY (can be personally liable)
- supply chain and provider management

DORA (Regulation EU 2022/2554)

What     DIGITAL operational resilience of the financial sector (banks, insurers, investment...)
Applies  since January 2025; it's a REGULATION (directly applicable, not transposed)
Pillars  1) ICT risk management  2) ICT incident notification
         3) resilience testing (incl. TLPT/advanced pentest for large ones)
         4) ICT third-party risk (critical providers, incl. cloud)
         5) information sharing

NIS2 vs DORA

NIS2   directive (transposed), horizontal (many sectors), a cybersecurity baseline
DORA   regulation (direct), vertical (financial), focus on OPERATIONAL RESILIENCE
# for a financial entity, DORA prevails as lex specialis on ICT matters

Practical implications

- TLPT (Threat-Led Penetration Testing): advanced intelligence-led pentest (DORA)
- incident logging and classification with strict deadlines (link with dfir-incidentes)
- due diligence and contracts with ICT/critical providers (grc-riesgos)
- management is accountable: cybersecurity rises to the board

Blue Team / GRC

Map the organization to NIS2 (essential/important?) and, if financial, to DORA.
Prepare incident notification with the deadlines (24h/72h/1 month) in the IR plan (Incident response).
Manage third-party/supply-chain risk (Risk management) as the regulation requires.
A resilience-testing program (TLPT/pentest) and documented management accountability.

Real cases and fines

DORA applicable since January 2025 forced banks and insurers to formalize ICT resilience and TLPT.
NIS2 vastly expanded the number of obligated entities versus NIS1.
Intelligence-led pentest frameworks (TIBER-EU) are the basis of DORA’s TLPT.

Testing checklist

Determine applicability (NIS2 essential/important; DORA if financial)
Art. 21 NIS2 risk-management measures implemented
Notification process with deadlines (24h/72h/1 month) in the IR
ICT third-party/provider risk management
DORA: 5 pillars, incl. resilience testing (TLPT)
Documented management accountability and reporting
Alignment with frameworks (Frameworks (ISO 27001, NIST, ENS, CIS)) and GDPR (GDPR & privacy)