DORA vs NIS2: what a NIS2 programme already covers
For EU financial entities, DORA takes the place of NIS2's security rules. Most of the work is the same; the differences sit in third-party risk, testing and reporting.
If you work in an EU financial entity, the question isn't whether DORA or NIS2 applies to your security programme. NIS2 lets a sector-specific Union act with at least equivalent cybersecurity requirements take precedence, and for the financial sector that act is the Digital Operational Resilience Act, Regulation (EU) 2022/2554, which has applied since 17 January 2025.
The practical question is different: if you already built a NIS2 programme, or you run one for the rest of your group, how much of it carries over? Our data answers that article by article.
The headline number
Of the 22 DORA articles, 20 (91%) map to something in NIS2, 1 are only loosely related and 1 have no mapping in our data. Open the gap report →
Read this as "where your NIS2 work already points", not as "done". No published crosswalk links DORA to NIS2, so every link here is ControlMapping editorial: we mapped DORA at paragraph and point level to the same security topics as the NIS2 Implementing Regulation, and the reason for each link is shown on the requirement page.
DORA article by article
| DORA | Requirement | Match | NIS2 |
|---|---|---|---|
| Art.5(2)(a) | Governance and organisation | Editorial | 2.17.11.22.2 |
| Art.6(1) | ICT risk management framework | Editorial | 2.17.113.113.2 |
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — |
| Art.8(1) | Identification | Editorial | 12.112.42.16.5 |
| Art.9(1) | Protection and prevention | Editorial | 3.212.212.31.1 |
| Art.10(1) | Detection | Editorial | 3.23.410.210.4 |
| Art.11(1) | Response and recovery | Editorial | 4.14.33.13.5 |
| Art.12(1) | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | 4.24.1 |
| Art.13(1) | Learning and evolving | Editorial | 3.53.68.18.2 |
| Art.14(1) | Communication | Editorial | 4.3 |
| Art.16(1) | Simplified ICT risk management framework | Editorial | 2.17.1 |
| Art.17(1) | ICT-related incident management process | Editorial | 3.13.54.3 |
| Art.18(1) | Classification of ICT-related incidents and cyber threats | Editorial | 3.13.33.5 |
| Art.19(1) | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | 3.3 |
| Art.24(1) | General requirements for the performance of digital operational resilience testing | Editorial | 2.17.1 |
| Art.25(1) | Testing of ICT tools and systems | Editorial | 6.56.10 |
| Art.26(1) | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | 6.56.10 |
| Art.27(1) | Requirements for testers for the carrying out of TLPT | Editorial | 6.56.10 |
| Art.28(2) | General principles | Editorial | 5.16.15.2 |
| Art.29(1) | Preliminary assessment of ICT concentration risk at entity level | Editorial | 5.16.1 |
| Art.30(2) | Key contractual provisions | Editorial | 5.15.26.112.5 |
| Art.45(1) | Information-sharing arrangements on cyber threat information and intelligence | 2.14.36.10 |
The overlap is broad because both texts describe the same programme: a documented risk management framework, asset identification, protection and detection, incident handling, business continuity and supplier security. Where DORA has a direct counterpart in the Implementing Regulation, the subject matches; the detail often doesn't.
What DORA adds
- A register of information. Article 28(3) requires a register of every contractual arrangement for ICT services, kept at entity and group level, with yearly reporting to the competent authority. NIS2 asks you to manage supplier security; it doesn't ask for a regulated register.
- Mandatory contract terms. Article 30 lists what every ICT services contract must contain, including where data is processed, access to and return of data, assistance in an incident at no extra cost or a cost set in advance, and termination rights. Contracts for critical or important functions add audit rights, participation in threat-led testing and exit periods.
- Concentration risk and exit. Before contracting, Article 29 asks whether a provider would be hard to substitute and how subcontracting chains affect you; Article 28(8) requires tested exit strategies for critical or important functions.
- Threat-led penetration testing. Entities selected by their authority must run TLPT on live production systems at least every three years (Article 26), with testers that meet the requirements of Article 27. NIS2's Implementing Regulation asks you to assess the effectiveness of your measures; it doesn't prescribe TLPT.
- Incident classification and staged reports. Article 18 sets the criteria that decide whether an incident is major, and Article 19 requires an initial notification, intermediate reports and a final report. NIS2 has its own clock: an early warning within 24 hours, a notification within 72 hours and a final report within a month. If you report under both regimes in different parts of a group, keep two procedures.
- Named management body duties. Both make management accountable. DORA spells out what the management body must approve, from the digital operational resilience strategy to the policy on ICT third-party services (Article 5(2)).
The other direction
Of the 49 NIS2 requirement points, 44 (90%) map to something in DORA, 5 are only loosely related and 0 have no mapping in our data. Open the gap report →
Coming from DORA, NIS2's Implementing Regulation adds little that is new in substance. A few requirement points only share a broad outcome with DORA in our data, usually because DORA covers the subject in its technical standards, which we don't map. Check these:
| NIS2 | Requirement | Match | DORA |
|---|---|---|---|
| 6.2 | Secure development life cycle | Art.8(1)Art.8(4)Art.8(6) | |
| 6.3 | Configuration management | Art.28(8)Art.30(2) | |
| 6.9 | Protection against malicious and unauthorised software | Art.9(1)Art.10(1)Art.10(3)Art.10(2) | |
| 10.1 | Human resources security | Art.5(4)Art.10(3)Art.13(6) | |
| 10.3 | Termination or change of employment procedures | Art.10(3) |
If you have already built for NIS2
- Confirm which regime applies to each entity in the group. Financial entities follow DORA; other group companies may stay under NIS2.
- Reuse the core. Risk assessment, asset inventories, access control, logging, incident response and continuity plans carry over; adjust their review frequencies to DORA's (for example, the ICT risk management framework is reviewed at least once a year).
- Build the third-party layer. Start the register of information early and review your contract templates against Article 30. This is usually the largest piece of new work.
- Plan testing. Even if your authority hasn't selected you for TLPT, Article 24 requires a testing programme, with yearly tests of the systems that support critical or important functions.
- Split the reporting procedures where both regimes apply in the group.
Key takeaways
- NIS2 work covers most of DORA's subject matter; the gap analysis shows it requirement by requirement.
- DORA's distinctive work is third-party risk: the register, contract terms, concentration risk and exit.
- Threat-led penetration testing and DORA's incident classification have no NIS2 equivalent.
Where to go next
The DORA framework page lists every article we map with its official text, the NIS2 vs DORA comparison shows both directions in full, and our NIS2 guide covers the NIS2 side.
Questions
Does a financial entity have to comply with both DORA and NIS2?
For its ICT risk management and incident reporting, a financial entity in DORA's scope follows DORA: NIS2 lets a sector-specific Union act with at least equivalent requirements take precedence, and DORA is that act for the financial sector. Groups that also contain non-financial entities, and ICT providers that serve banks, can still meet both.
Is there an official mapping between DORA and NIS2?
No published crosswalk links the two. The links on ControlMapping are editorial: we mapped DORA at paragraph and point level to the same security topics as NIS2's Implementing Regulation, and every link shows its reason.
What does DORA require that NIS2 doesn't?
Mainly a register of information on all ICT service contracts, a detailed list of mandatory contract terms, an assessment of ICT concentration risk, exit strategies, and threat-led penetration testing at least every three years for entities their authority selects.
Data as of 2026-10-27: numbers in this post are computed from the current crosswalk and update when it changes. Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Not compliance advice.
Related posts
Analysis · 2026-10-27APRA CPS 234 and ISO 27001: what your ISMS covers and what APRA addsAn ISO 27001 ISMS covers nearly every paragraph of APRA's CPS 234, yet APRA adds Board duties, third-party assurance and strict notification deadlines.
Analysis · 2026-10-27Cyber Essentials vs the Essential Eight: two national baselines comparedThe UK's Cyber Essentials and Australia's Essential Eight both target common attacks, but they cover different ground. What overlaps, what doesn't, and why.
Analysis · 2026-10-13MFA requirements compared across 11 security frameworksWhich frameworks require MFA, for whom and how strictly: PCI DSS, CMMC, NIS2, Essential Eight, ISO 27001, SOC 2 and HIPAA compared side by side.