NIS 2 versus DORA-Framework

NIS 2 and DORA are European Union regulations that were published on December 27, 2022. Although they both deal with digital operational security in the financial sector, there are some important differences between them.

The full name of DORA is "Regulation (EU) 2022/2554 on digital operational security in the financial sector". This is a regulation that is directly applicable and therefore binding for financial institutions across the European Union. In contrast, NIS 2 is a directive that stipulates that companies must act in accordance with local laws.

Another important difference is to which organizations the regulations apply. While NIS 2 applies to all companies that are classified as essential or important entities, DORA only applies to financial institutions.

The protection offered by both regulations also differs. While NIS 2 focuses on cybersecurity measures, DORA includes additional measures for the general resilience of financial institutions. This aspect is particularly important to minimize the impact of cyberattacks on the financial sector.

In addition, NIS 2 and DORA come into force at different times. NIS 2 is valid from October 18, 2024, while DORA does not come into force until January 17, 2025.

Overall, NIS 2 and DORA are important steps by the EU to strengthen digital operational security in the financial sector and improve resilience to cyberattacks. While NIS 2 is primarily aimed at protecting sensitive data through cybersecurity measures, DORA places additional emphasis on the general resilience of financial institutions. The combination of these two regulations is intended to ensure a higher level of security and protection in the financial sector.