NIS2 and DORA: which text applies to a financial entity?

Banking and financial market infrastructures are among the sectors of high criticality listed in NIS2. The same entities have been subject to DORA since January 2025. For a CISO in the financial sector, the question is simple: which obligations apply, and to whom do you answer?

The principle: the sector-specific text prevails

Article 4 of NIS2 provides that where a sector-specific Union legal act requires risk-management measures or reporting obligations that are at least equivalent, its provisions apply instead of those of NIS2. Recital 28 of the directive explicitly names DORA as that sector-specific act for the financial sector.

In practice, for a financial entity subject to DORA, ICT risk management, incident reporting and resilience testing follow DORA’s rules, not Articles 21 and 23 of NIS2.

What does not disappear

DORA does not replace the whole NIS2 ecosystem:

• financial entities remain part of the national cybersecurity landscape, and financial authorities cooperate with the authorities and CSIRTs designated under NIS2;
• an entity of a financial group that does not itself fall within DORA’s scope may remain subject to NIS2;
• ICT providers to the financial sector are affected by DORA through their contracts, and may be subject to NIS2 for their own activity.

The applicable text therefore has to be mapped entity by entity, rather than at group level.

In France, a single law for both

The bill on the resilience of critical infrastructure and the strengthening of cybersecurity, still before Parliament, transposes NIS2, the critical entities resilience directive and the directive that accompanies DORA together. It organises the coordination between ANSSI and the financial authorities, the ACPR and the AMF.

What to remember

For a financial entity, DORA sets the rules for ICT risk management and incident reporting; NIS2 still matters for scope, cooperation between authorities and group entities outside DORA. Establishing that exact scope, then a single governance that answers both texts without duplication, is where a Trusted Assessment starts, followed by Trusted Organisation.