Article 2(1) of Regulation (EU) 2022/2554 lists DORA's addressees: 20 types of financial entity, from credit institutions to securitisation repositories, plus ICT third-party service providers. In Germany, NIS2 covers entities of a type listed in Annex 1 or Annex 2 of the BSI Act (BSIG), under § 28 BSIG. An entity is important under § 28(2) no. 3 BSIG if it has at least 50 employees, or annual turnover and balance sheet total each above EUR 10 million.
What is the difference between DORA and NIS2?
The difference between DORA and NIS2 is one of design: DORA is sector law for finance, NIS2 a cross-sector minimum framework. Under Article 1(1), the regulation sets uniform DORA requirements for financial entities, which regulatory and implementing technical standards then fill in. Article 5 of Directive (EU) 2022/2555, by contrast, sets only a minimum level that Member States may exceed.
That decides which text governs. For financial entities it is the regulation and its Level 2 acts. For entities in Germany it is the BSIG, which sets out the NIS2 obligations in Germany, not the directive itself.
Does DORA or NIS2 apply to our company?
Whether DORA, NIS2 or both apply depends on the type of company. The table maps five constellations to their legal basis.
| Company | DORA | NIS2 in Germany (BSIG) |
|---|---|---|
| Credit institution | Financial entity under Article 2(1)(a) | Entity type under Annex 1 no. 3.1.1; §§ 30–32, 35, 36, 38 and 39 do not apply under § 28(6) no. 1 |
| Trading venue, central counterparty | Financial entity under Article 2(1)(h) and (i) | Entity types under Annex 1 no. 3.2; same exemptions as for credit institutions |
| Insurance undertaking, investment firm, payment institution | Financial entity under Article 2(1)(n), (e) and (b) | Not listed as an entity type in Annex 1 or 2 |
| IT service provider to a financial entity | Directly only as a critical ICT third-party service provider (Article 31); otherwise through the contract clauses under Article 30 | An entity if it belongs to an entity type in Annex 1 or 2 and meets the threshold |
| Company with no link to the financial sector | Not covered | An entity if entity type and size fit |
So not every financial entity is also a NIS2 entity: insurers, investment firms and payment institutions appear in neither annex. A company that shows up in both columns allocates its obligations by the precedence of sector law.
Can a company fall under DORA and NIS2 at the same time?
Yes. A credit institution with at least 50 employees is a financial entity under DORA and also an important or essential entity under § 28 BSIG. Article 4 of the directive resolves the conflict in favour of sector law; § 28(6) BSIG sets its reach in Germany.
In groups with both financial and non-financial companies, the two regimes apply side by side, each to different companies. Check the entity type company by company. For size, § 28(4) BSIG adds partner and linked enterprises under Commission Recommendation 2003/361/EC. That does not apply where the company is independent of them in its IT systems and processes.
Side by side
| Criterion | DORA | NIS2 |
|---|---|---|
| Legal form | Regulation (EU) 2022/2554; applies directly and in identical wording in all Member States. | Directive (EU) 2022/2555; takes effect through national law, in Germany through the NIS-2-Umsetzungsgesetz in the BSIG. |
| Applicable | Since 17 January 2025 (Article 64). | NIS-2-Umsetzungsgesetz in force since 6 December 2025. |
| Addressees | 20 types of financial entity under Article 2(1)(a) to (t), such as credit institutions, investment firms and insurance undertakings, plus ICT third-party service providers. | Essential and important entities under § 28 BSIG, for example in energy, health, finance and digital infrastructure (Annex 1) or manufacturing (Annex 2). |
| Precedence | Under Article 1(2), counts as a sector-specific act within the meaning of Article 4 of Directive (EU) 2022/2555 for financial entities. | Gives way under Article 4(1) where sector-specific requirements are at least equivalent; implemented in Germany by § 28(6) no. 1 BSIG. |
| Risk management | Documented ICT risk management framework under Chapter II (Articles 5–16); a simplified framework for the entities named in Article 16(1). | Appropriate, proportionate measures under § 30 BSIG, covering at least the ten areas of § 30(2) sentence 2. |
| Reporting route | Major ICT-related incidents go to the authority competent under Article 46 (Article 19(1)). | Significant security incidents go to the joint reporting office of the BSI and the BBK (§ 32(1) BSIG). |
| First notification | Initial notification within 4 hours of classification as major, no later than 24 hours after becoming aware (Article 5(1) Delegated Regulation (EU) 2025/301). | Early initial notification without undue delay, no later than 24 hours after becoming aware (§ 32(1) no. 1 BSIG). |
| Second notification | Intermediate report no later than 72 hours after the initial notification. | Notification no later than 72 hours after becoming aware (§ 32(1) no. 2); an intermediate report only on request of the BSI (no. 3). |
| Final report | No later than one month after the intermediate report or the latest updated intermediate report. | No later than one month after the 72-hour notification; if the incident is ongoing, a progress report first (§ 32(2)). |
| Resilience testing | Annual tests of systems supporting critical or important functions (Article 24(6)); TLPT at least every three years for entities the authority identifies (Article 26). | Policies to assess the effectiveness of the measures (§ 30(2) sentence 2 no. 6); the act sets no cadence and no test type. |
| Third parties | Contract content, exit strategies and a register of information (Chapter V Section I, Articles 28–30). | Supply chain security as an area of measures (§ 30(2) sentence 2 no. 4); the BSIG requires no register of information. |
| Oversight of providers | European oversight framework for critical ICT third-party service providers (Chapter V Section II, Articles 31–44); the European supervisory authorities published a first list in November 2025. | No framework of its own; a provider is covered only if it is itself an entity under § 28 BSIG. |
| Management body | Bears ultimate responsibility for managing ICT risk (Article 5(2)(a)) and keeps its knowledge up to date, including through training (Article 5(4)). | Management implements and oversees the measures (§ 38(1)), is liable to the entity for culpably caused damage (§ 38(2)) and takes part in training at regular intervals (§ 38(3)). |
| Supervisory authority | The financial supervisor competent under Article 46; for credit institutions BaFin or the ECB (§ 6(1g) KWG), with the Bundesbank running TLPT operationally. | The BSI; without a specific cause for essential entities (§ 61), on a specific cause for important entities (§ 62). |
Our verdict
A financial entity within the meaning of DORA aligns ICT risk management, incident reporting, resilience testing and third-party risk with DORA. Alongside that, it checks the BSIG duties that § 28(6) no. 1 does not exempt, among them registration. Any other company follows the BSIG if its entity type and size fit; DORA reaches it only as a critical ICT provider or through customer contracts.
How far does DORA's precedence over NIS2 reach?
DORA's precedence has a condition and a scope. The shorthand "lex specialis" is correct, but it does not describe a blanket exemption from the BSIG.
Both acts set the condition. Article 1(2) DORA covers financial entities identified as essential or important entities. For them, the regulation "shall be considered a sector-specific Union legal act for the purposes of Article 4 of that Directive". Article 4(2) of the directive sets two alternative tests of equivalence:
- The risk-management measures are at least equivalent in effect to those in Article 21(1) and (2).
- The act gives CSIRTs immediate access to incident notifications, and its reporting requirements are at least equivalent to Article 23(1) to (6).
In Germany, § 28(6) no. 1 BSIG sets the scope. It covers financial entities under Article 2(2) DORA. It also covers companies to which DORA applies through § 1a(2) and (2a) of the Banking Act (KWG) or § 293(5) of the Insurance Supervision Act (VAG). It exempts them from seven provisions:
| BSIG provision | Subject | Exempted under § 28(6) no. 1 |
|---|---|---|
| §§ 30, 31 | Risk-management measures; special requirements for operators of critical installations | yes |
| § 32 | Reporting duties | yes |
| §§ 35, 36 | Duties to inform; the BSI's feedback to reporting entities | yes |
| §§ 38, 39 | Duties of the management body; evidence duties for operators of critical installations | yes |
| § 33 | Registration duty | no |
| §§ 61, 62 | Supervisory and enforcement measures | no |
For telecommunications and certain energy undertakings, § 28(5) BSIG names §§ 61 and 62 explicitly; § 28(6) does not. Article 4(1) of the directive, by contrast, also disapplies the supervision provisions of its Chapter VII where equivalence is met. What follows for an individual institution needs legal review. A plan that treats the precedence as a full exemption from the BSIG has no basis in the wording.
Which reporting deadlines apply to a financial entity that is also a NIS2 entity?
Such a financial entity follows the DORA deadlines, because § 28(6) no. 1 exempts it from the reporting duty under § 32 BSIG. Reports go to the authority competent under Article 46 DORA; for credit institutions, § 6(1g) KWG designates BaFin or the ECB. The deadlines are not in the regulation itself: Article 19(4) refers to Article 20, and Article 5 of Delegated Regulation (EU) 2025/301 sets them.
NIS2 status still affects the DORA clock. Where a deadline falls on a weekend or public holiday, Article 5(4) lets a financial entity report by noon of the next working day. That applies to the initial notification and to the intermediate and final reports.
Credit institutions, central counterparties and operators of trading venues lose that relief for the initial notification and the intermediate report (Article 5(5)). The same applies to other financial entities identified as essential or important entities under Article 3 of the directive.
Conversely, § 28(7) BSIG lifts the § 32 reporting duty for operators of critical installations insofar as they run one for such a financial entity.
What can companies under both regimes share?
The content both regimes require can be shared. Three areas of measures in § 30(2) sentence 2 BSIG have a counterpart in DORA:
| § 30(2) sentence 2 BSIG | DORA |
|---|---|
| No. 2: handling of security incidents | Article 17: ICT-related incident management process |
| No. 3: business continuity | Article 11: response and recovery, ICT business continuity policy |
| No. 4: supply chain security | Article 28: ICT third-party risk |
A group under both regimes can use the same risk management, measures and evidence for these areas.
The formal parts stay separate: the reporting routes to different authorities, the DORA register of information and threat-led penetration testing (TLPT). The BSIG has no counterpart to the register or to TLPT; the register templates are set by Implementing Regulation (EU) 2024/2956. How far an ISMS to ISO 27001 carries the NIS2 obligations is covered in the comparison NIS2 vs ISO 27001.
Both acts on one asset register in Rizzqo
In Rizzqo, DORA is held as a requirement catalogue, and each DORA requirement appears on the supporting assets whose category it is mapped to. NIS2 is supported in Rizzqo; its catalogue is enabled when a customer needs it. Both catalogues therefore sit on the same asset register. Primary assets such as processes and information carry a rating for confidentiality, integrity and availability; supporting assets have an owner and a category.
Answers to a requirement are finalised with name and timestamp, and evidence attaches to the requirement or to the task that implements it. Measures run as tasks that sync with Jira in both directions. Rizzqo computes coverage per supporting asset from the finalised answers; primary assets take it over from their supporting assets, and daily snapshots record the state.