Your sector determines which law applies, not your size
Whether NIS2 or DORA applies to your organization depends on the sector in which you operate, not on how many employees you have or how large your turnover is. DORA, the Digital Operational Resilience Act, is the European regulation specifically for the financial sector: banks, insurers, investment firms, payment institutions and a number of parties that provide IT services to these institutions. NIS2 is directed at all other sectors mentioned in Annexes I and II of the directive, from energy and transport to digital infrastructure and wastewater. A financial institution that is subject to DORA is therefore not also subject to NIS2 for those same activities.
The reason this question is often asked is that both regulations resemble each other: both require risk management, incident reporting and attention to supply chain partners. Anyone who has read the text of either one will almost automatically recognize the structure of the other. This makes it especially important to first establish which of the two frameworks your organization falls under, before you invest time in implementation.
What DORA regulates and for whom
DORA is written specifically for the financial sector because that sector is already under strict supervision, with its own supervisors such as DNB and the AFM in the Netherlands. The regulation lists a series of entities by name: credit institutions, payment institutions, electronic money institutions, investment firms, insurers and reinsurers, and pension funds, plus the critical ICT third parties that serve these institutions, such as major cloud providers. For these parties, DORA replaces the broad duty of care framework of NIS2 with a regulation tailored to financial risks and the supervision that already existed for them.
What NIS2 regulates and for whom
NIS2 covers the sectors listed in the directive itself: energy, transport, drinking water, digital infrastructure, healthcare, and a number of others designated in Annex I as essential and in Annex II as important. An installation company, a software provider or a logistics service provider not operating in the financial sector therefore looks at this list and not at DORA. in a few questions to see whether your sector is on that list provides a quick initial indication of this without you having to go through the full directive text.
Edge cases: when it is not immediately clear
Most organizations see within a minute which camp they are in. It becomes trickier with hybrid forms: an insurance intermediary, a factoring company, a fintech offering payment services without itself being a licensed payment institution, or an IT provider serving both banks and non-financial customers. In such cases, the precise legal status of the entity, and not the sector in which it considers itself at home, determines which regulation it falls under. Supervisors publish their own guidance on this, and for a concrete situation that is the appropriate point of contact, together with a lawyer who can compare the definitions in both texts with your actual activities.
A second complication arises with groups: a parent company that is subject to DORA as a financial institution may have a subsidiary that carries on an entirely different activity and is therefore assessed against NIS2 criteria separately. The two regulations look at the entity providing the service, not automatically at the group as a whole.
The supply chain mechanisms apply on both sides
What the two frameworks do have in common is that they extend beyond the parties who are themselves subject to obligations. Just as an organisation subject to NIS2 must assess its suppliers, DORA requires financial institutions to evaluate their ICT service providers and establish agreements about this. An IT supplier that provides services to a bank may therefore receive a questionnaire from the DORA side, while that same supplier receives a questionnaire from the NIS2 side from another type of customer. It is useful for that supplier to know which framework a question comes from, because the requested evidence documents are structured slightly differently. More on how such an incoming questionnaire works in detail can be found in the topics on supply chains and a customer's questionnaire.
How to verify this for your own organisation
The fastest way to get clarity for yourself is to look at your own licence or registration: if you have a licence from DNB or the AFM, or if you are one of the explicitly mentioned financial entities, that points towards DORA. If your sector is named in the annexes of the NIS2 Directive, that points towards NIS2. In case of doubt, it is not a detour to place both texts side by side, or to put the question directly to the competent authority. Secria focuses on the NIS2 side of this issue; at intake we identify financial institutions and refer them on, so that you do not work with the wrong checklist. How we determine sector and role in the supply chain exactly, and which sources we use for that, you can read on the page about how the information on this platform is compiled.
Would you like an indication first before you read further? Take the free NIS2 check or browse through the knowledge base with topics; both are accessible without an account and will give you an answer within half an hour that you can work with.