YTYK You think you know

Card 2 of 15 Scope — finance, and the suppliers behind it ●●○ Working knowledge

DORA beats NIS2 where both apply

Where a financial entity is in scope of both, DORA applies instead of NIS2 for ICT risk management and incident reporting. NIS2 itself says so: where a sector-specific EU act imposes at least equivalent requirements, those apply and the NIS2 obligations do not.

Why it is like this

Banks were about to be supervised twice for the same thing by two different authorities on two different clocks. Naming one as *lex specialis* resolves it in the only way that leaves a single answer to "who do I call".

Not to be confused with

A blanket exemption from NIS2. The displacement is subject-matter specific: it covers the ICT risk and incident provisions, not everything NIS2 does. And a financial entity may still appear in a national NIS2 register.

In practice

A bank hit by ransomware reports to its financial supervisor under DORA, not to the national CSIRT under NIS2 — and the deadlines are not the same ones.

Source: Directive (EU) 2022/2555 (NIS2) — NIS2 Art. 4, read with DORA Art. 1. Read on .

Connects to

  • NIS2 — NIS2's three clocks are the ones DORA displaces for financial entities
Predict Check yourself

A Belgian bank suffers a major ICT incident. Its CISO asks whether to run the NIS2 24-hour early warning. What is the answer?

  1. No — DORA applies instead of NIS2 for ICT incident reporting, so the DORA reporting path and its own deadlines govern.
  2. Yes, and the DORA report as well — both regimes run in parallel.
  3. Yes, because NIS2 covers the banking sector in Annex I.
  4. Only if the incident also involves personal data.
Show the answer

No — DORA applies instead of NIS2 for ICT incident reporting, so the DORA reporting path and its own deadlines govern.

This is the single most useful thing to know about the two together. Banking is in NIS2's Annex I, which is exactly why the lex specialis rule exists.