DORA a NIS2 – two legislative instruments of the EU
About the instruments
The European Union is continuously strengthening its regulations to increase digital resilience in the financial sector – the DORA regulation and the NIS2 directive are part of the constantly developing regulatory framework. While NIS2 is a general directive that individual EU member states must implement into their legislation, the DORA regulation clearly specifies requirements applicable to all without exception.
How do the two instruments differ and what do they bring for the individual entities concerned? What requirements must be met and are you ready for them?
Download PDF »
What requirements need to be met – NIS2 or DORA?
If the area of your business falls under regulated financial services, or if it directly meets the definition of CASP, it will fall under the scope ofthe DORA regulation and the implementation of the regulation's requirements will therefore represent a lex specialis for you. However, the fulfillment of DORA will also de facto fulfill the requirements of the NIS2 directive, as they overlap.
If your business does not fall under the aforementioned, it is necessary to determine whether NIS2 is applicable for you. The scope of NIS2 is defined on the basis of the industry and on the basis of the enterprise size. In simple terms, the directive is applicable to medium and larger enterprises (50 or more employees or assets / annual turnover exceeding EUR 10 million) from various areas – public administration, energy, healthcare, transport, manufacturing, chemical and food industry, water and waste management, digital infrastructure and digital services and more.
Both legislative instruments represent significant progress in cybersecurity, introducing the necessary requirements and standards to strengthenthe digital resilience of financial organizations and ensure the security ofcritical services across various industries.
Organizations should act quickly to comply with these changing legal frameworks, as failure to comply can have serious consequences – from fines to business suspension. Deloitte's team of compliance, cybersecurity, legal andother industry experts offers you holistic services aimed at assessing your readiness, advising and implementing the necessary steps to fulfill your obligations under both regulations.
Introducing any changes to business practice often means aligning processes, making changes within the organizational structure and technological base. This is also why it is important to prepare a good plan and, through a nin-depth analysis of the current situation, propose an implementation roadmap and specific changes that will then need to be implemented.
News
Opens in new window
