NIS2: multi-sector approach
Directive 2022/2555 covers multiple essential or important sectors. National laws set implementation details for governance, incidents and supervision.
DORA: finance-specific regime
Regulation 2022/2554 has applied since 17 January 2025 to covered financial entities. It addresses ICT risk, incident management, resilience testing, third-party risk and ICT contracts.
ICT suppliers may be affected through customers
Even when not regulated as a financial entity, a supplier may face customer requirements on inventories, auditability, subcontractors, continuity, exit rights and records. Applicability needs case-by-case assessment.
Practical method
Identify entity classification and applicable laws first. Then map critical services, dependencies, contracts and evidence; keep legal responsibility separate from technical delivery.
At a glance
| Aspect | NIS2 | DORA |
|---|---|---|
| Coverage | Multiple sectors | Regulated finance |
| Legal form | Transposed directive | Directly applicable regulation |
| Focus | Cyber risk/incident | ICT resilience & suppliers |
How SFERE can support
SFERE: service, dependency, vendor and evidence mapping; no definitive legal applicability ruling.
Official laws, standards & publisher resources
This is an editorial explanation. Verify consolidated laws, applicable standards and interpretations for your activity, country and date. Full standards may require a licence.