Comparison
NIS2 vs DORA
NIS2 Implementing Regulation (EU) 2024/2690 · DORA (Regulation (EU) 2022/2554) · data 2026-10-27
Requirement-level comparison of NIS2 Implementing Regulation (EU) 2024/2690 and DORA (Regulation (EU) 2022/2554), in both directions, derived from published crosswalks and ControlMapping's curated topics.
Of 22 DORA (Regulation (EU) 2022/2554) requirements, 20 map to something in NIS2, 1 are only loosely related, and 1 have no mapping in our data.
DORA here means the articles that bind financial entities, mapped editorially at paragraph level. The technical standards that add detail, such as Delegated Regulation (EU) 2024/1774, are not mapped, so technical topics they cover show no link.
Likely new work: DORA requirements with no mapping to NIS2 (1)
| DORA | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 1 | ||||
| Art.7 | ICT systems, protocols and tools | No mapping in our data | — | No mapping to NIS2 in our data. |
Check these: only loosely related (a shared CSF outcome, not a mapping) (1)
| DORA | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Chapter VI: Information sharing · 1 | ||||
| Art.45 | Information-sharing arrangements on cyber threat information and intelligence | 2.14.36.10 | Only shares CSF ID.RA-02, ID.RA-03, DE.AE-07: related, not a mapping | |
Mapped (20)
| DORA | Requirement | Match | NIS2 | Evidence |
|---|---|---|---|---|
| Chapter II: ICT risk management · 10 | ||||
| Art.5 | Governance and organisation | Editorial | 2.17.11.2+4 | Same topic: Risk Management, Roles & Responsibilities (editorial pick) |
| Art.6 | ICT risk management framework | Editorial | 2.17.113.1+5 | Same topic: Risk Management, Physical Security (editorial pick) |
| Art.8 | Identification | Editorial | 12.112.42.1+2 | Same topic: Data Classification, Asset Management, Risk Assessment (editorial pick) |
| Art.9 | Protection and prevention | Editorial | 3.212.212.3+12 | Same topic: Cont. Monitoring, Data Protection (editorial pick) |
| Art.10 | Detection | Editorial | 3.23.410.2+1 | Same topic: Intrusion Detection, Anomaly Detection, Insider Threat (editorial pick) |
| Art.11 | Response and recovery | Editorial | 4.14.33.1+1 | Same topic: Business Continuity, Incident Response (editorial pick) |
| Art.12 | Backup policies and procedures, restoration and recovery procedures and methods | Editorial | 4.24.1 | Same topic: Backup & Recovery, Disaster Recovery (editorial pick) |
| Art.13 | Learning and evolving | Editorial | 3.53.68.1+1 | Same topic: Forensics, Lessons Learned, Awareness & Training (editorial pick) |
| Art.14 | Communication | Editorial | 4.3 | Same topic: Communication (editorial pick) |
| Art.16 | Simplified ICT risk management framework | Editorial | 2.17.1 | Same topic: Risk Management (editorial pick) |
| Chapter III: ICT-related incidents · 3 | ||||
| Art.17 | ICT-related incident management process | Editorial | 3.13.54.3 | Same topic: Incident Response, Communication (editorial pick) |
| Art.18 | Classification of ICT-related incidents and cyber threats | Editorial | 3.13.33.5 | Same topic: Incident Response, Reporting (editorial pick) |
| Art.19 | Reporting of major ICT-related incidents and voluntary notification of significant cyber threats | Editorial | 3.3 | Same topic: Reporting (editorial pick) |
| Chapter IV: Resilience testing · 4 | ||||
| Art.24 | General requirements for the performance of digital operational resilience testing | Editorial | 2.17.1 | Same topic: Risk Management (editorial pick) |
| Art.25 | Testing of ICT tools and systems | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.26 | Advanced testing of ICT tools, systems and processes based on TLPT | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| Art.27 | Requirements for testers for the carrying out of TLPT | Editorial | 6.56.10 | Same topic: Vulnerability Mgmt (editorial pick) |
| Chapter V: ICT third-party risk · 3 | ||||
| Art.28 | General principles | Editorial | 5.16.15.2 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| Art.29 | Preliminary assessment of ICT concentration risk at entity level | Editorial | 5.16.1 | Same topic: Supply Chain Risk (editorial pick) |
| Art.30 | Key contractual provisions | Editorial | 5.15.26.1+1 | Same topic: Vendor Risk Mgmt, Cloud Security (editorial pick) |
Of 49 NIS2 Implementing Regulation (EU) 2024/2690 requirements, 44 map to something in DORA, 5 are only loosely related, and 0 have no mapping in our data.
NIS2 here is the technical measures of Implementing Regulation (EU) 2024/2690, which applies directly to digital-infrastructure and ICT-service providers; other NIS2 entities follow their country's transposition of Article 21. Incident reporting deadlines (Article 23) are not in scope. ENISA's mapping is non-binding.
Check these: only loosely related (a shared CSF outcome, not a mapping) (5)
| NIS2 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| 6. Security in acquisition, development and maintenance · 3 | ||||
| 6.2 | Secure development life cycle | Art.8(1)Art.8(4)Art.8(6) | Only shares CSF ID.AM-08: related, not a mapping | |
| 6.3 | Configuration management | Art.28(8)Art.30(2) | Only shares CSF PR.PS-01: related, not a mapping | |
| 6.9 | Protection against malicious and unauthorised software | Art.9(1)Art.10(1)Art.10(3)+1 | Only shares CSF DE.CM-01, DE.CM-09: related, not a mapping | |
| 10. Human resources security · 2 | ||||
| 10.1 | Human resources security | Art.5(4)Art.10(3)Art.13(6) | Only shares CSF PR.AT-02, GV.RR-04: related, not a mapping | |
| 10.3 | Termination or change of employment procedures | Art.10(3) | Only shares CSF GV.RR-04: related, not a mapping | |
Mapped (44)
| NIS2 | Requirement | Match | DORA | Evidence |
|---|---|---|---|---|
| 1. Policy on the security of network and information systems · 2 | ||||
| 1.1 | Policy on the security of network and information systems | Editorial | Art.5(2)(b)Art.6(5)Art.9(4)(a) | Same topic: Governance Policy (editorial pick) |
| 1.2 | Roles, responsibilities and authorities | Editorial | Art.5(2)(c)Art.5(3)Art.6(4) | Same topic: Roles & Responsibilities (editorial pick) |
| 2. Risk management policy · 3 | ||||
| 2.1 | Risk management framework | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+5 | Same topic: Risk Management (editorial pick) |
| 2.2 | Compliance monitoring | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| 2.3 | Independent review of information and network security | Editorial | Art.5(2)(f)Art.6(6)Art.6(7) | Same topic: Compliance (editorial pick) |
| 3. Incident handling · 6 | ||||
| 3.1 | Incident handling policy | Editorial | Art.11(2)(b)Art.17(1)Art.17(3)+1 | Same topic: Incident Response (editorial pick) |
| 3.2 | Monitoring and logging | Editorial | Art.9(1)Art.10(1)Art.10(2)+1 | Same topic: Cont. Monitoring, Intrusion Detection, SIEM / SOC (editorial pick) |
| 3.3 | Event reporting | Editorial | Art.18(1)Art.19(1)Art.19(3)+1 | Same topic: Reporting (editorial pick) |
| 3.4 | Event assessment and classification | Editorial | Art.10(1)Art.10(2)Art.10(3) | Same topic: Anomaly Detection, SIEM / SOC (editorial pick) |
| 3.5 | Incident response | Editorial | Art.11(2)(b)Art.11(2)(c)Art.13(2)+5 | Same topic: Incident Response, Mitigation, Forensics (editorial pick) |
| 3.6 | Post-incident reviews | Editorial | Art.13(2)Art.13(3) | Same topic: Lessons Learned (editorial pick) |
| 4. Business continuity and crisis management · 3 | ||||
| 4.1 | Business continuity and disaster recovery plan | Editorial | Art.11(1)Art.11(3)Art.11(4)+3 | Same topic: Business Continuity, Recovery Planning (editorial pick) |
| 4.2 | Backup management | Editorial | Art.11(6)Art.12(1)Art.12(2)+2 | Same topic: Disaster Recovery, Backup & Recovery (editorial pick) |
| 4.3 | Crisis management | Editorial | Art.11(1)Art.11(2)(e)Art.11(4)+5 | Same topic: Business Continuity, Comms & Restore (editorial pick) |
| 5. Supply chain security · 2 | ||||
| 5.1 | Supply chain security policy | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| 5.2 | Directory of suppliers and service providers | Editorial | Art.28(3)Art.28(4)Art.28(5)+3 | Same topic: Vendor Risk Mgmt (editorial pick) |
| 6. Security in acquisition, development and maintenance · 7 | ||||
| 6.1 | Security in acquisition of ICT services, ICT systems or ICT products | Editorial | Art.28(2)Art.28(3)Art.28(4)+6 | Same topic: Supply Chain Risk, Vendor Risk Mgmt (editorial pick) |
| 6.4 | Change management, repairs and maintenance | Editorial | Art.9(4)(e) | ControlMapping editorial: All three require documented, risk-based change management in which changes are recorded, tested, approved and verified. |
| 6.5 | Security testing | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| 6.6 | Security patch management | Editorial | Art.9(4)(f) | Same topic: Patch Management (editorial pick) |
| 6.7 | Network security | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| 6.8 | Network segmentation | Editorial | Art.9(4)(b) | Same topic: Firewall / Net Seg (editorial pick) |
| 6.10 | Vulnerability handling and disclosure | Editorial | Art.8(2)Art.25(1)Art.26(1)+1 | Same topic: Vulnerability Mgmt (editorial pick) |
| 7. Assessing the effectiveness of cybersecurity risk-management measures · 1 | ||||
| 7.1 | Policies and procedures to assess the effectiveness of cybersecurity risk-management measures | Editorial | Art.5(2)(a)Art.6(1)Art.6(8)+2 | Same topic: Risk Management (editorial pick) |
| 8. Basic cyber hygiene practices and security training · 2 | ||||
| 8.1 | Awareness raising and basic cyber hygiene practices | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| 8.2 | Security training | Editorial | Art.5(4)Art.13(6) | Same topic: Awareness & Training (editorial pick) |
| 9. Cryptography · 1 | ||||
| 9.1 | Cryptography | Editorial | Art.9(3)(a)Art.9(4)(d) | Same topic: Encryption (editorial pick) |
| 10. Human resources security · 2 | ||||
| 10.2 | Verification of Background | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| 10.4 | Disciplinary process | Editorial | Art.10(3) | Same topic: Insider Threat (editorial pick) |
| 11. Access control · 7 | ||||
| 11.1 | Access control policy | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| 11.2 | Management of access rights | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| 11.3 | Privileged accounts and system administration accounts | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| 11.4 | Administration systems | Editorial | Art.9(4)(c) | Same topic: Privileged Access (editorial pick) |
| 11.5 | Identification | Editorial | Art.9(4)(c) | Same topic: Access Control (editorial pick) |
| 11.6 | Authentication | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| 11.7 | Multi-factor authentication | Editorial | Art.9(4)(d) | Same topic: Multi-Factor Auth (editorial pick) |
| 12. Asset management · 5 | ||||
| 12.1 | Asset classification | Editorial | Art.8(1) | Same topic: Data Classification (editorial pick) |
| 12.2 | Handling of assets | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| 12.3 | Removable media policy | Editorial | Art.9(2)Art.9(3)(c)Art.9(3)(d) | Same topic: Data Protection (editorial pick) |
| 12.4 | Asset inventory | Editorial | Art.8(1)Art.8(4)Art.8(6) | Same topic: Asset Management (editorial pick) |
| 12.5 | Deposit, return or deletion of assets upon termination of employment | Editorial | Art.30(2)(d) | ControlMapping editorial: Access to, return and deletion of data and assets when a contract or relationship ends. |
| 13. Environmental and physical security · 3 | ||||
| 13.1 | Supporting utilities | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| 13.2 | Protection against physical and environmental threats | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
| 13.3 | Perimeter and physical access control | Editorial | Art.6(2)Art.9(4)(c) | Same topic: Physical Security (editorial pick) |
By topic
Both cover (37):
Governance PolicyAwareness & TrainingRisk ManagementSupply Chain RiskRoles & ResponsibilitiesComplianceAsset ManagementRisk AssessmentData ClassificationVulnerability MgmtAccess ControlMulti-Factor AuthEncryptionData ProtectionBackup & RecoveryPrivileged AccessFirewall / Net SegPatch ManagementCloud SecurityCont. MonitoringLogging & AuditIntrusion DetectionAnomaly DetectionSIEM / SOCIncident ResponseForensicsCommunicationMitigationReportingRecovery PlanningBusiness ContinuityLessons LearnedComms & RestoreDisaster RecoveryInsider ThreatVendor Risk MgmtPhysical Security
Only NIS2 (6):
Only DORA (2):
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. Mapped = curated together in a ControlMapping topic, or linked directly. Crosswalks don't prove compliance. Methodology · Download the data · Report a mistake.