NIS2 and DORA Compliance
NIS2 applies from October 2024, DORA from January 2025. Companies in 18 sectors must meet requirements or risk fines up to €10 million. Gap analysis, implementation plan, and audit preparation support.
Fines up to €10 million for non-compliance - regulators are already auditing
Complete NIS2 and DORA preparation
Gap Analysis
Compliance assessment against 10 requirement areas
Implementation Plan
Roadmap with priorities and timeline
Implementation Support
Help in meeting compliance requirements
Company Received €2 Million Fine - Didn’t Know They Were Subject to NIS2
A logistics operator didn’t register as an NIS2-covered entity. They had no incident management procedures. After a ransomware attack, they didn’t report the incident to CSIRT within the required 24-hour timeframe. Regulator imposed fine: €2 million + mandate to implement all requirements within 90 days. Total cost including implementation: €3.5 million.
Without NIS2/DORA preparation:
- Risk fines up to €10 million or 2% of annual turnover
- Don’t know if you’re subject to regulations (18 NIS2 sectors)
- Lose contracts - partners require compliance
- Regulator can order business suspension
Comprehensive Path to Compliance
We don’t leave you with a list of requirements. We guide you from the first meeting to successful audit completion. We deliver ready documentation templates, help implement technical controls, and prepare you for regulator communication.
What you get:
- Assessment whether you’re subject to NIS2 or DORA (qualification: essential/important entity)
- Gap analysis against 10 NIS2 areas and DORA chapters
- Cybersecurity maturity assessment
- Implementation roadmap - prioritized action plan with timeline
- Ready templates: policies, procedures, registers, forms
- Support in implementing technical controls (SIEM, VM, backup, IR)
- Preparation for incident reporting to CSIRT
- Training for management and teams (awareness, obligations)
- Support in preparing for regulator audit
- Optionally: ongoing compliance oversight (virtual CISO)
Who Is It For?
This service is for you if:
- You operate in one of 18 NIS2 sectors (energy, transport, finance, e-commerce…)
- You’re a financial institution subject to DORA
- You have more than 50 employees or €10 million turnover (NIS2 criteria)
- You provide digital services (cloud, DNS, registry, marketplace)
- You want to avoid fines and be ready for regulator audit
NIS2 Directive
Who Does NIS2 Apply To?
18 critical sectors:
- Energy (production, transmission, distribution of electricity, gas, oil)
- Transport (air, rail, water, road)
- Banking and financial market infrastructure
- Healthcare (hospitals, laboratories, pharmaceutical production)
- Drinking water and wastewater
- Digital infrastructure (cloud, data centers, CDN, DNS, registry)
- Public administration (government, local authorities)
- Space
- Waste management
- Food production, processing, and distribution
- E-commerce (online marketplaces)
- Postal and courier services
- ICT service management (B2B)
Size thresholds:
- Essential entities: medium and large enterprises
- Important entities: SMEs above 50 employees OR €10 million turnover
10 NIS2 Requirement Areas
- Risk management policies - identification, assessment, mitigation
- Incident management - detection, response, reporting (24h)
- Business continuity and crisis management - backup, DR, BCP
- Supply chain security - ICT supplier assessment
- Security of system acquisition, development, and maintenance - secure SDLC
- Effectiveness assessment policies and procedures - tests, audits, KPIs
- Basic cyber hygiene practices - MFA, encryption, patching
- Cybersecurity training - awareness for everyone
- Cryptography and encryption - data at rest and in transit
- Human resources security - access control, offboarding
NIS2 Violation Penalties
Essential entities:
- Up to €10 million OR 2% of annual global turnover (whichever is higher)
- Personal liability of management
Important entities:
- Up to €7 million OR 1.4% of annual turnover
NIS2 Incident Reporting
3 reporting levels:
- Early warning (24h) - notification of significant incident
- Notification (72h) - initial incident assessment
- Final report (1 month) - detailed report with impact and actions
Where to report: National CSIRT
DORA Regulation
Who Does DORA Apply To?
Financial institutions:
- Banks and credit institutions
- Investment firms
- Payment institutions and EMIs
- Insurance companies
- Pension and investment funds
- Crypto-asset service providers
Third-party ICT providers:
- Cloud providers for financial sector
- Software vendors
- Data analytics providers
5 DORA Pillars
- ICT risk management - framework, identification, protection
- ICT incident management - classification, reporting to regulator
- Digital resilience testing - TLPT (threat-led penetration testing)
- ICT third-party risk management - due diligence, SLA, audits
- Information sharing - threat intelligence, best practices
Key DORA Requirements
ICT Risk Management Framework:
- ICT risk management policy approved by management board
- Identification of all critical functions and dependencies
- Resilience testing at least once a year (every 3 years TLPT for large entities)
Incident reporting:
- Major incident: 4h (initial notification)
- Intermediate report: after situation stabilization
- Final report: with root cause analysis and remediation actions
DORA Timeline
- 17 January 2025 - full DORA application
- 17 January 2024 - entry into force
- Q4 2024 - Q1 2025 - technical standards publication (RTS/ITS)
How we work
Our proven service delivery process.
Scoping
Determine if you're subject to NIS2/DORA and scope
Gap Analysis
Current state assessment vs regulatory requirements
Roadmap
Prioritized remediation action plan
Implementation
Control and documentation deployment
Audit Support
Audit preparation and support
Benefits for your business
What you gain by choosing this service.
Avoid Fines
Up to €10M or 2% turnover for NIS2
Audit Readiness
Documentation and processes meeting requirements
Competitive Advantage
Clients and partners require compliance
Organized Processes
Clear roles, procedures, risk management
Related Articles
Expand your knowledge with our resources.
Why SOC is Practically Essential for KSC/NIS2 Compliance
KSC/NIS2 regulations don't explicitly require having a SOC. However, the 24-hour serious incident reporting obligation makes it practically impossible to meet requirements without mature monitoring mechanisms.
Read more →CER: six months to full implementation - what critical infrastructure must do
The CER Directive (Critical Entities Resilience) imposes new obligations on critical infrastructure operators. By July 2026, critical entities must implement resilience measures. Time is running out - here's what you need to know.
Read more →NIS2 directive is now in force - what does it mean for your business?
The NIS2 directive has fundamentally changed cybersecurity requirements across the European Union. Thousands of companies in new sectors now face mandatory security measures, incident reporting, and potential fines reaching 10 million EUR. Here's what you need to know and do before enforcement catches up with you.
Read more →Frequently Asked Questions
Common questions about NIS2 and DORA Compliance.
Who does the NIS2 directive apply to?
NIS2 applies to companies in 18 sectors: energy, transport, banking, healthcare, water, digital infrastructure, public administration, space, postal services, food, chemicals, manufacturing, waste management, and more. Entities are divided into essential and important.
What are the penalties for NIS2 non-compliance?
NIS2 violation penalties can reach €10 million or 2% of global turnover (for essential entities) and €7 million or 1.4% of turnover (for important entities). Additionally, management bears personal responsibility.
How long does NIS2 implementation take?
Typical NIS2 implementation takes 3-6 months depending on current cybersecurity maturity. Gap analysis takes 2-4 weeks, roadmap development 1-2 weeks, and control implementation 2-4 months.
What's the difference between NIS2 and DORA?
NIS2 is a general cybersecurity directive for 18 sectors. DORA (Digital Operational Resilience Act) is a regulation dedicated to the financial sector with more detailed requirements for digital resilience, testing, and ICT risk management.
How much does NIS2 preparation cost?
NIS2 preparation costs depend on organization size and current security posture. Gap analysis for a mid-sized company is €3,500 - €9,000. Full implementation with documentation and support is typically €12,000 - €45,000.
Contact your account manager
Discuss NIS2 and DORA Compliance with your dedicated account manager.