The regulation

What DORA and NIS2 are and who they apply to

NIS2 is the European directive that extends cybersecurity obligations to many more sectors: energy, transport, health, water, digital infrastructure, public administration, manufacturing and food, among others. It mainly affects medium-sized and large companies in those sectors.

DORA is the European regulation on digital operational resilience for the financial sector. It has applied since January 17, 2025 to banks, insurers, payment institutions, asset managers and other financial entities, and it also reaches the ICT providers that serve them.

Neither can be certified like an ISO standard: you comply with them and demonstrate it to supervisors and clients. A well-implemented ISO 27001 is the best foundation for doing so.

Does it apply to you?

Tick everything that applies to your organization.

You are a financial entity: bank, insurer, payment institution or asset manager
You provide technology services to financial entities
You operate in energy, transport, health, water, digital infrastructure or another critical sector
You are a supplier to a company in those sectors
You have 50 or more employees, or turnover above €10 million
You already have ISO 27001 or the ENS

Tick at least one option.

DORA applies to you. You will need to show how you manage technology risk, incidents and your suppliers.

NIS2 probably applies to you. It depends on your exact sector and size, so it's worth checking as soon as possible.

Both DORA and NIS2 apply to you. You can tackle both with a single work plan.

Your ISO 27001 or ENS already covers a good part of what they require.

By size you could fall under NIS2, but what really decides it is your sector.

If you are not in an affected sector and don't work for one, they don't apply to you directly. Your ISO 27001 or ENS leaves you well prepared if that changes.

Let's talk →

Let us explain →

One foundation for several standards

What you already have in place works for you

ISO 27001

Its controls cover much of the risk, incident and supplier management that DORA and NIS2 require.

ISO 27001 implementation → ENS

If you work with the Spanish Public Administration, the ENS shares many of the measures NIS2 requires.

ENS certification →

Frequently asked questions

What people ask us before getting started

Open allClose all

Is there a DORA or NIS2 certificate?

No. There is no official DORA or NIS2 certificate: you comply with them and demonstrate it to supervisors and clients. Certifications such as ISO 27001 or the ENS help prove it.

What does NIS2 require?

Cybersecurity risk management measures, reporting of significant incidents with an early warning within 24 hours, supply chain security and direct accountability for management.

What does DORA require?

A technology risk management framework, reporting of major incidents, regular resilience testing and oversight of ICT providers, with a register of all contracts with them.

If I supply a company that is affected, does it apply to me?

Indirectly, yes. Both regulations require companies to oversee their suppliers' security, so your clients will ask you for guarantees, contract clauses and, often, certifications.

What happens if I don't comply?

Penalties can be high. Under NIS2 they can reach €10 million or 2% of total worldwide annual turnover for essential entities, and management can be held personally liable.

Where do I start?

With a gap analysis: we look at what applies to you, what you already have covered and what is missing, and turn it into a prioritized work plan.

Shall we talk about your compliance?

Tell us where you stand and we'll explain what you still need to comply.

Contact us

Compliance DORA and NIS2

What DORA and NIS2 are and who they apply to

Does it apply to you?

What you already have in place works for you

What people ask us before getting started

Shall we talk about your compliance?