DORA vs NIS2: Which One Applies to Your Company?

In summary, NIS2 applies to essential and important entities across the sectors listed in its annexes. DORA applies to financial entities in the European Union and to the ICT providers serving them. Financial entities can fall within both, and DORA operates as the sector-specific regime where the two would otherwise overlap. 

Which organisations does NIS2 cover? 

NIS2, formally Directive (EU) 2022/2555, covers organisations in sectors the directive lists across two annexes, split into essential entities and important entities.

Annex I — Sectors of high criticality (11)

1. Energy — electricity, district heating and cooling, oil, gas, hydrogen
2. Transport — air, rail, water, road
3. Banking — credit institutions
4. Financial market infrastructures — trading venues, central counterparties
5. Health — hospitals, EU reference laboratories, pharmaceutical manufacturers, critical medical device manufacturers
6. Drinking water — suppliers and distributors
7. Wastewater — collection, disposal, treatment
8. Digital infrastructure — internet exchange points, DNS service providers, TLD name registries, cloud computing, data centres, content delivery networks, trust service providers, electronic communications
9. ICT service management (business-to-business) — managed service providers, managed security service providers
10. Public administration — central and regional government entities
11. Space — operators of ground-based infrastructure

Annex II — Other critical sectors (7)

1. Postal and courier services
2. Waste management
3. Manufacture, production and distribution of chemicals
4. Production, processing and distribution of food
5. Manufacturing — medical devices, computer, electronic and optical products, electrical equipment, machinery, motor vehicles, other transport equipment
6. Digital providers — online marketplaces, online search engines, social networking platforms
7. Research — research organisations

The classification determines how supervision works: essential entities face proactive oversight, important entities face supervision triggered by evidence of non-compliance. Size thresholds apply, with exceptions for certain sectors regardless of headcount. 

Which organisations does DORA cover? 

DORA, formally Regulation (EU) 2022/2554, covers financial entities operating in the European Union: banks, insurers, investment firms, payment institutions, crypto-asset service providers and others named in the regulation. DORA also reaches ICT third-party service providers serving those entities, primarily through mandatory contractual provisions set out in Articles 28 to 30. 

What happens when both DORA and NIS2 apply? 

A financial entity can sit inside the scope of both instruments. NIS2 addresses this in Article 4: where a sector-specific Union legal act imposes requirements at least equivalent to those in NIS2, the corresponding NIS2 provisions do not apply. DORA functions as that sector-specific act for financial entities, so DORA governs and duplication is avoided rather than doubled. 

How does the hiring profile change between a NIS2 client and a DORA client? 

The regime changes what the client is buying. A NIS2 client is usually buying technical capability first: detection and response, plus a governance, risk, and compliance specialist who can own the notification chain and map controls to the directive. A DORA client shifts weight toward governance. 

We see the difference in the briefs themselves. A DORA-driven search asks for someone who understands ICT third-party risk, contractual oversight, register-of-information requirements, and resilience testing expectations. A NIS2-driven search more often pulls a detection engineering hire with a governance layer added on top. A DORA search pulls a governance hire who can also sit across the table from a supervisor, not only from an internal auditor. For role scoping under either regime, see cybersecurity services. 

Candidates fluent in both regimes exist, and those candidates are the scarce profile.

What should a company do with this distinction? 

Scope determination comes before hiring. Establishing which regime applies, and in which member state, decides whether the first hire should be technical or governance-weighted. Companies that hire before answering that question routinely end up with a capable team missing the one function a supervisor will ask about. 

NIS2 and DORA obligations depend on the entity, the sector, the member state, and the contract. This text describes how the two regimes divide scope and is not legal advice. We strongly recommend confirming your own position with qualified legal counsel. Broader context in the pillar article on cybersecurity regulation across Europe.