NIS2 and DORA Compliance
NIS2 applies from October 2024, DORA from January 2025. Companies in 18 sectors must meet requirements or risk fines up to €10 million. Gap analysis, implementation plan, and audit preparation support.
What is NIS2 and DORA compliance?
NIS2 (Network and Information Security Directive 2) and DORA (Digital Operational Resilience Act) are EU regulations imposing cybersecurity obligations on entities across 18 essential sectors and the financial sector. nFlo conducts gap analysis, builds an implementation roadmap, and prepares organizations for compliance audits — minimizing the risk of fines up to €10 million.
Fines up to €10 million for non-compliance - regulators are already auditing
Complete NIS2 and DORA preparation
Gap Analysis
Compliance assessment against 10 requirement areas
Implementation Plan
Roadmap with priorities and timeline
Implementation Support
Help in meeting compliance requirements
Company Received €2 Million Fine - Didn’t Know They Were Subject to NIS2
A logistics operator didn’t register as an NIS2-covered entity. They had no incident management procedures. After a ransomware attack, they didn’t report the incident to CSIRT within the required 24-hour timeframe. Regulator imposed fine: €2 million + mandate to implement all requirements within 90 days. Total cost including implementation: €3.5 million.
Without NIS2/DORA preparation:
- Risk fines up to €10 million or 2% of annual turnover
- Don’t know if you’re subject to regulations (18 NIS2 sectors)
- Lose contracts - partners require compliance
- Regulator can order business suspension
Comprehensive Path to Compliance
We don’t leave you with a list of requirements. We guide you from the first meeting to successful audit completion. We deliver ready documentation templates, help implement technical controls, and prepare you for regulator communication.
What you get:
- Assessment whether you’re subject to NIS2 or DORA (qualification: essential/important entity)
- Gap analysis against 10 NIS2 areas and DORA chapters
- Cybersecurity maturity assessment
- Implementation roadmap - prioritized action plan with timeline
- Ready templates: policies, procedures, registers, forms
- Support in implementing technical controls (SIEM, VM, backup, IR)
- Preparation for incident reporting to CSIRT
- Training for management and teams (awareness, obligations)
- Support in preparing for regulator audit
- Optionally: ongoing compliance oversight (virtual CISO)
Who Is It For?
This service is for you if:
- You operate in one of 18 NIS2 sectors (energy, transport, finance, e-commerce…)
- You’re a financial institution subject to DORA
- You have more than 50 employees or €10 million turnover (NIS2 criteria)
- You provide digital services (cloud, DNS, registry, marketplace)
- You want to avoid fines and be ready for regulator audit
NIS2 Directive
Who Does NIS2 Apply To?
18 critical sectors:
- Energy (production, transmission, distribution of electricity, gas, oil)
- Transport (air, rail, water, road)
- Banking and financial market infrastructure
- Healthcare (hospitals, laboratories, pharmaceutical production)
- Drinking water and wastewater
- Digital infrastructure (cloud, data centers, CDN, DNS, registry)
- Public administration (government, local authorities)
- Space
- Waste management
- Food production, processing, and distribution
- E-commerce (online marketplaces)
- Postal and courier services
- ICT service management (B2B)
Size thresholds:
- Essential entities: medium and large enterprises
- Important entities: SMEs above 50 employees OR €10 million turnover
10 NIS2 Requirement Areas
- Risk management policies - identification, assessment, mitigation
- Incident management - detection, response, reporting (24h)
- Business continuity and crisis management - backup, DR, BCP
- Supply chain security - ICT supplier assessment
- Security of system acquisition, development, and maintenance - secure SDLC
- Effectiveness assessment policies and procedures - tests, audits, KPIs
- Basic cyber hygiene practices - MFA, encryption, patching
- Cybersecurity training - awareness for everyone
- Cryptography and encryption - data at rest and in transit
- Human resources security - access control, offboarding
NIS2 Violation Penalties
Essential entities:
- Up to €10 million OR 2% of annual global turnover (whichever is higher)
- Personal liability of management
Important entities:
- Up to €7 million OR 1.4% of annual turnover
NIS2 Incident Reporting
3 reporting levels:
- Early warning (24h) - notification of significant incident
- Notification (72h) - initial incident assessment
- Final report (1 month) - detailed report with impact and actions
Where to report: National CSIRT
DORA Regulation
Who Does DORA Apply To?
Financial institutions:
- Banks and credit institutions
- Investment firms
- Payment institutions and EMIs
- Insurance companies
- Pension and investment funds
- Crypto-asset service providers
Third-party ICT providers:
- Cloud providers for financial sector
- Software vendors
- Data analytics providers
5 DORA Pillars
- ICT risk management - framework, identification, protection
- ICT incident management - classification, reporting to regulator
- Digital resilience testing - TLPT (threat-led penetration testing)
- ICT third-party risk management - due diligence, SLA, audits
- Information sharing - threat intelligence, best practices
Key DORA Requirements
ICT Risk Management Framework:
- ICT risk management policy approved by management board
- Identification of all critical functions and dependencies
- Resilience testing at least once a year (every 3 years TLPT for large entities)
Incident reporting:
- Major incident: 4h (initial notification)
- Intermediate report: after situation stabilization
- Final report: with root cause analysis and remediation actions
DORA Timeline
- 17 January 2025 - full DORA application
- 17 January 2024 - entry into force
- Q4 2024 - Q1 2025 - technical standards publication (RTS/ITS)
Related Glossary Terms
Learn more about key concepts related to this service:
Contact your account manager
Discuss NIS2 and DORA Compliance with your dedicated account manager.
How we work
Our proven service delivery process.
Scoping
Determine if you're subject to NIS2/DORA and scope
Gap Analysis
Current state assessment vs regulatory requirements
Roadmap
Prioritized remediation action plan
Implementation
Control and documentation deployment
Audit Support
Audit preparation and support
Benefits for your business
What you gain by choosing this service.
Avoid Fines
Up to €10M or 2% turnover for NIS2
Audit Readiness
Documentation and processes meeting requirements
Competitive Advantage
Clients and partners require compliance
Organized Processes
Clear roles, procedures, risk management
Related Articles
Expand your knowledge with our resources.
Cyber threat landscape 2026: a report for Polish companies in the NIS2 era
CERT Poland registered a record 260,783 incidents in 2025 (+152% YoY), and the amendment to the KSC act implementing NIS2 took effect on 3 April 2026. See what really threatens Polish companies and where to start preparing.
Read more →Essential Entity in Energy — a KSC/NIS2 Obligations Checklist and Key Deadlines
The energy sector falls under essential entities within the meaning of KSC/NIS2 — with the highest level of supervision and requirements. We have gathered the organisational, technical and reporting obligations into one practical checklist, along with the key deadlines from which it is worth planning your work.
Read more →NIS2 in the Energy Sector: From a "Paper Audit" to Real, Risk-Based Resilience
Meeting NIS2 requirements is not a completed checklist but a living risk-management programme. We explain how compliance "on paper" differs from real resilience and how a power utility should set priorities when not everything can be secured at once.
Read more →Frequently Asked Questions
Common questions about NIS2 and DORA Compliance.
Who does the NIS2 directive apply to?
NIS2 applies to companies in 18 sectors: energy, transport, banking, healthcare, water, digital infrastructure, public administration, space, postal services, food, chemicals, manufacturing, waste management, and more. Entities are divided into essential and important.
What are the penalties for NIS2 non-compliance?
NIS2 violation penalties can reach €10 million or 2% of global turnover (for essential entities) and €7 million or 1.4% of turnover (for important entities). Additionally, management bears personal responsibility.
How long does NIS2 implementation take?
Typical NIS2 implementation takes 3-6 months depending on current cybersecurity maturity. Gap analysis takes 2-4 weeks, roadmap development 1-2 weeks, and control implementation 2-4 months.
What's the difference between NIS2 and DORA?
NIS2 is a general cybersecurity directive for 18 sectors. DORA (Digital Operational Resilience Act) is a regulation dedicated to the financial sector with more detailed requirements for digital resilience, testing, and ICT risk management.
How much does NIS2 preparation cost?
NIS2 preparation costs depend on organization size and current security posture. Gap analysis for a mid-sized company is €3,500 - €9,000. Full implementation with documentation and support is typically €12,000 - €45,000.