NIS2 for financial services: when DORA applies instead, and where CER fits

For financial services, DORA applies instead of NIS2. NIS2 names only three financial entity types: credit institutions, operators of trading venues and central counterparties. For those, DORA replaces the NIS2 rules on risk management, incident reporting and supervision. Insurers, investment firms, payment institutions and fund managers are not NIS2 entities at all: DORA alone applies.

This guide covers which financial firms NIS2 lists, how DORA displaces it, DORA’s requirements and deadlines, a comparison, critical ICT providers, CER, ICT suppliers, and a checklist.

Firm type	In NIS2 Annex I?	In DORA?	What you follow
Credit institution (bank)	Yes, point 3	Yes	DORA; NIS2 at the edges
Trading venue operator or CCP	Yes, point 4	Yes	DORA; NIS2 at the edges
Investment firm, payment or e-money institution	No	Yes	DORA
Insurer, reinsurer, AIFM or UCITS management company	No	Yes	DORA
Central securities depository, crypto-asset service provider	No	Yes	DORA
ICT provider to financial entities	Often (cloud, data centre, MSP)	Through contracts	NIS2 itself, plus DORA clauses

Does NIS2 apply to financial services?

Only to three entity types, in two sectors of Annex I:

• Point 3, banking: credit institutions as defined in Article 4(1) of Regulation (EU) No 575/2013.
• Point 4, financial market infrastructures: operators of trading venues as defined in Article 4(24) of Directive 2014/65/EU, and central counterparties as defined in Article 2(1) of Regulation (EU) No 648/2012.

That is the whole list. Insurers, investment firms, payment institutions, fund managers and central securities depositories appear in neither annex. The Commission’s 2023 guidelines on Article 4 confirm that the entity types covered by both NIS2 and DORA “include credit institutions, trading venues and central counterparties”.

For those three types, the normal scope rules apply: medium-sized or larger entities are in scope (Article 2(1)), and those above the medium-sized ceilings are essential (Article 3). Two special cases:

• A critical entity under the CER Directive is in scope regardless of size (Article 2(3)) and is essential (Article 3(1)(f)).
• NIS2 does not apply to entities a Member State has exempted from DORA under DORA Article 2(4) (Article 2(10)).

The general rules are in who NIS2 applies to; the NIS2 checker gives a first answer.

NIS2 and DORA: which applies to a bank?

DORA, for almost everything. NIS2 Article 4(1) says that where a sector-specific EU act imposes risk-management or incident notification requirements at least equivalent in effect, the relevant NIS2 provisions, including supervision and enforcement, do not apply. DORA Article 1(2) says that, for financial entities identified as essential or important under national rules transposing NIS2 Article 3, DORA “shall be considered a sector-specific Union legal act for the purposes of Article 4”. DORA recital 16 calls it lex specialis.

NIS2 recital 28 gives the result: DORA’s rules on ICT risk management, incident management and reporting, resilience testing, information-sharing and ICT third-party risk “should apply instead of those provided for in this Directive”.

In practice, a bank does not run Article 21 measures alongside DORA, does not file NIS2 early warnings, and answers to its financial supervisor. Per the Commission’s guidelines, Article 20 on management bodies should not apply either; DORA Article 5 does that job.

What NIS2 still does for a DORA entity

• Identification. DORA Article 1(2) is framed around entities identified under NIS2 Article 3. The Commission’s guidelines say the NIS2 list and registration provisions (Articles 3(3) and 27(2)) should not apply to such entities, but Member States may still list them. Check your national law.
• Incident information. The DORA supervisor passes details of major incidents to the NIS2 authorities, single points of contact or CSIRTs (DORA Article 19(6)). Member States may also require entities to send their DORA reports to the NIS2 authorities or CSIRTs (Article 19(1)).
• Crisis management. Per the guidelines, NIS2 national cyber crisis frameworks (Article 9) and EU-CyCLONe (Article 16) should continue to apply.
• Deadlines. Banks, trading venues, CCPs and other NIS2 entities lose a DORA weekend extension for initial and intermediate reports, explained below.

What does DORA require?

DORA, Regulation (EU) 2022/2554, has applied directly in every Member State since 17 January 2025 (Article 64).

Article 2(1) lists 20 types of financial entity, plus ICT third-party service providers. They include banks, payment and e-money institutions, investment firms, market infrastructures, crypto-asset service providers, fund managers, insurers and insurance intermediaries, occupational pension institutions, credit rating agencies, critical benchmark administrators and crowdfunding service providers. Article 2(3) excludes, among others, small AIFMs, small insurers and insurance intermediaries that are SMEs.

Pillar	DORA chapter	Core duty
ICT risk management	II (Articles 5 to 16)	Documented framework, reviewed at least yearly
Incident reporting	III (Articles 17 to 23)	Classify incidents, report major ones
Resilience testing	IV (Articles 24 to 27)	Annual tests for critical or important functions; TLPT for selected entities
ICT third-party risk	V (Articles 28 to 44)	Register, concentration risk, contract clauses, critical provider oversight
Information sharing	VI (Article 45)	Voluntary sharing of cyber threat information

The management body bears ultimate responsibility for ICT risk (Article 5(2)), and its members must actively keep their knowledge up to date, including through regular specific training (Article 5(4)). Threat-led penetration testing (TLPT) is required at least every three years, and only for entities the supervisor identifies (Article 26).

What are the DORA incident reporting deadlines?

A major ICT-related incident is reported to the financial supervisor in three stages (DORA Article 19(4)). Article 5 of Delegated Regulation (EU) 2025/301 sets the time limits:

Report	DORA deadline	NIS2, for comparison
Initial notification	4 hours after classifying the incident as major, at most 24 hours after becoming aware	Early warning within 24 hours
Intermediate report	72 hours after the initial notification, even if nothing changed	Incident notification within 72 hours
Final report	One month after the latest intermediate report	One month after the incident notification

Classification follows Delegated Regulation (EU) 2024/1772; the templates are in Implementing Regulation (EU) 2025/302. If an incident is only classified as major after the first 24 hours, the initial notification is due within 4 hours of classification (Article 5(2)). A deadline falling on a weekend or bank holiday may be met by noon on the next working day, except for initial notifications and intermediate reports from credit institutions, CCPs, trading venue operators and other entities identified as essential or important under NIS2. Clients whose financial interests are affected must be told without undue delay (DORA Article 19(3)).

The ESAs’ first report on DORA major incidents (June 2026, covering 2025) counted 3,383. Only 10% were related to cybersecurity; system failures and external events were the main drivers. A process that only looks for attackers misses most reportable incidents. The NIS2 stages are in the NIS2 incident reporting timeline.

NIS2 vs DORA: how do they compare?

	NIS2	DORA
Legal form	Directive, national laws due to apply from 18 October 2024	Regulation, directly applicable since 17 January 2025
Financial scope	Credit institutions, trading venue operators, CCPs	20 types of financial entity
Risk management	Ten minimum measures, all-hazards (Art. 21)	ICT risk management framework (Arts 5 to 16)
Incident reporting	24 hours, 72 hours, one month (Art. 23)	4 hours after classification (24 after awareness at most), 72 hours, one month
Testing	Policies to assess effectiveness (Art. 21(2)(f))	Annual testing; TLPT at least every three years for selected entities
Third-party risk	Supply chain security (Art. 21(2)(d) and (3))	Register, concentration risk, mandatory clauses, critical provider oversight
Supervisors	National NIS2 authorities	Financial supervisors, ECB for significant banks; ESAs for critical ICT providers
Penalties	Maximum of at least €10M or 2% of turnover (essential), €7M or 1.4% (important) (Art. 34)	Set by Member States (Art. 50); critical ICT providers: daily penalties up to 1% of average daily worldwide turnover

What are the register of information and critical provider oversight?

The register. Article 28(3) requires every financial entity to keep a register of all contractual arrangements for ICT services, marking those that support critical or important functions. At least yearly, the entity reports new arrangements to its supervisor; the full register goes on request. The templates are in Implementing Regulation (EU) 2024/2956. Article 29 requires a concentration risk assessment before contracting for critical or important functions, for example when a provider is not easily substitutable. DORA sets no hard concentration limits.

Critical ICT third-party providers. The ESAs designate them and assign each a lead overseer (Article 31). On 18 November 2025 they published the first list: 19 providers across cloud, data centres, telecoms, market data and IT services. A lead overseer can impose daily penalty payments of up to 1% of average daily worldwide turnover, for up to six months (Article 35). Where such a provider is also a NIS2 essential entity, the NIS2 authority must inform the DORA Oversight Forum when it takes supervisory or enforcement action (NIS2 Article 32(10)).

Where does the CER Directive fit?

CER is Directive (EU) 2022/2557 on the resilience of critical entities against non-cyber risks; matters covered by NIS2 are excluded (CER Article 1(2)). It is not the Cyber Resilience Act, which regulates products with digital elements (see the CRA reporting duty). CER’s Annex lists the same financial entity types as NIS2.

1. Identification. Member States had to identify critical entities by 17 July 2026 (Article 6(1)). That date has passed; identified entities are notified within one month (Article 6(3)).
2. Few direct duties. Under Article 8, Member States “shall ensure that Article 11 and Chapters III, IV and VI do not apply” to critical entities in banking, financial market infrastructure and digital infrastructure. A bank identified as critical has no CER risk assessment, resilience measures, background checks or incident notification duties, unless national law adds them. The national framework in Chapter II still applies (recital 21).
3. The NIS2 link. A critical entity is in NIS2 regardless of size (NIS2 Article 2(3)) and is essential (Article 3(1)(f)). For a credit institution below the NIS2 size threshold, CER identification is what brings it in. DORA still applies instead for risk management and reporting.

What does DORA mean for ICT providers to financial entities?

An ICT provider is not a financial entity, but DORA reaches it through contracts. Financial entities may only use ICT providers that comply with appropriate information security standards (Article 28(5)), and Article 30 lists what the contract must contain. Cloud, data centre and managed service providers may also be NIS2 entities in their own right.

DORA ARTICLE 30: CLAUSES AN ICT PROVIDER SHOULD EXPECT

All ICT service contracts (Art. 30(2))
[ ] Services described; subcontracting terms for critical
    or important functions
[ ] Service and data locations; advance notice of changes
[ ] Data availability, authenticity, integrity, confidentiality
[ ] Access to and return of data on insolvency or termination
[ ] Service level descriptions
[ ] Incident assistance at no extra cost or a cost set ex ante
[ ] Full cooperation with the client's supervisors
[ ] Termination rights and minimum notice periods
[ ] Participation in the client's security awareness training

Critical or important functions, in addition (Art. 30(3))
[ ] Precise quantitative and qualitative performance targets
[ ] Notice of developments that could affect the service
[ ] Tested contingency plans and ICT security measures
[ ] Participation in the client's TLPT
[ ] Unrestricted access, inspection and audit rights
[ ] Exit strategy with a mandatory adequate transition period

In practice, audit rights, TLPT cooperation and incident assistance cost a supplier most. A sensible approach is to prepare once: a standard DORA addendum, a subcontractor and location list, an incident notification commitment that leaves your client time for its 4-hour limit, and an evidence pack. How to negotiate these schedules is in the security annex, clause by clause; the NIS2 side is in NIS2 supply chain risk.

What DORA leaves open in practice

• The clock needs timestamps. A supervisor will ask when you became aware and when you classified. The answer must come from system records, not memory.
• Classification needs numbers. If it takes a day to count affected clients, the 24-hour outer limit is gone.
• The register drifts. Built from procurement records, it misses services bought on a card and the subcontractors behind your providers.
• Functions need a map. Testing, the register and classification all depend on knowing which systems support which critical or important function.
• Groups need one process. A group with a DORA bank and a NIS2 subsidiary needs one incident process that routes each case to the right regime.

All of this is evidence held in your own systems. Collected continuously, with a person reviewing exceptions, it is ready when the supervisor asks. That is how the CloudSoul platform works, as an automated platform with human-in-the-loop expertise. The wider programme is on the NIS2 compliance page.

NIS2 and DORA checklist for financial firms

• Confirm your entity type against NIS2 Annex I and DORA Article 2(1).
• If you are a bank, trading venue or CCP, check how your national NIS2 law lists DORA entities.
• Ask your supervisor whether you were identified as a critical entity under CER.
• Test incident classification against the DORA deadlines, including a weekend.
• Reconcile the register of information with the ICT services actually in use.
• Map ICT systems to critical or important functions and plan annual testing.
• Review ICT contracts against Article 30, critical or important functions first.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 2, 3, 4, 9, 16, 20, 21, 23, 27, 32(10), 34 and 41, recital 28, Annex I points 3 and 4, EUR-Lex.
• Regulation (EU) 2022/2554 (DORA), Articles 1, 2, 5, 6, 19, 24, 26, 28 to 31, 35, 45, 46, 50 and 64, recital 16, EUR-Lex.
• Commission Delegated Regulation (EU) 2025/301, Article 5, EUR-Lex.
• Commission Implementing Regulation (EU) 2025/302, EUR-Lex.
• Commission Delegated Regulation (EU) 2024/1772, EUR-Lex.
• Commission Implementing Regulation (EU) 2024/2956, EUR-Lex.
• Directive (EU) 2022/2557 (CER), Articles 1, 6 and 8, recital 21 and Annex, EUR-Lex.
• Commission Guidelines on the application of Article 4(1) and (2) of Directive (EU) 2022/2555, 2023/C 328/02, EUR-Lex.
• ESAs, designation of critical ICT third-party providers, 18 November 2025, EBA.
• ESAs, first report on DORA major ICT-related incidents, 3 June 2026, EBA.

Frequently asked questions