NIS2 and DORA Compliance
EU member states had to transpose the NIS2 Directive into national law by 17 October 2024, and DORA has applied since 17 January 2025. Companies in 18 sectors must meet requirements or risk NIS2 fines up to €10 million. Gap analysis, implementation plan, and audit preparation support.
Describe your scope — your account manager will reply within 24 hours.
- Free quote
What is NIS2 and DORA compliance?
NIS2 (Network and Information Security Directive 2) and DORA (Digital Operational Resilience Act) are EU regulations imposing cybersecurity obligations on entities across 18 essential sectors and the financial sector. nFlo conducts gap analysis, builds an implementation roadmap, and prepares organizations for compliance audits — minimizing the risk of NIS2 fines up to €10 million.
Contact your account manager
Discuss NIS2 and DORA Compliance with your dedicated account manager.
Fines up to €10 million for non-compliance - regulators are already auditing
Complete NIS2 and DORA preparation
Gap Analysis
Compliance assessment against 10 requirement areas
Implementation Plan
Roadmap with priorities and timeline
Implementation Support
Help in meeting compliance requirements
What Happens Without NIS2 Preparation
Without NIS2/DORA preparation:
- Risk fines: under NIS2 up to €10 million or 2% of annual turnover; for DORA breaches, in Poland, up to PLN 20,869,500 or 10% of total annual revenue (Art. 18zm of the Act on Financial Market Supervision)
- Don’t know if you’re subject to regulations (18 NIS2 sectors)
- Lose contracts - partners require compliance
- Regulator can order business suspension
Comprehensive Path to Compliance
We don’t leave you with a list of requirements. We guide you from the first meeting to successful audit completion. We deliver ready documentation templates, help implement technical controls, and prepare you for regulator communication.
What you get:
- Assessment whether you’re subject to NIS2 or DORA (qualification: essential/important entity)
- Gap analysis against 10 NIS2 areas and DORA chapters
- Cybersecurity maturity assessment
- Implementation roadmap - prioritized action plan with timeline
- Ready templates: policies, procedures, registers, forms
- Support in implementing technical controls (SIEM, VM, backup, IR)
- Preparation for incident reporting to CSIRT
- Training for management and teams (awareness, obligations)
- Support in preparing for regulator audit
- Optionally: ongoing compliance oversight (virtual CISO)
Who Is It For?
This service is for you if:
- You operate in one of 18 NIS2 sectors (energy, transport, finance, e-commerce…)
- You’re a financial institution subject to DORA
- You have more than 50 employees or €10 million turnover (NIS2 criteria)
- You provide digital services (cloud, DNS, registry, marketplace)
- You want to avoid fines and be ready for regulator audit
Which NIS2 service should you choose?
At nFlo, NIS2 preparation is three consecutive steps. Each one is a separate service with its own price — you can start with any of them and stop there.
| NIS2 Readiness Check | NIS2/KSC audit (gap analysis) | NIS2 implementation (NIS2 and DORA Compliance) | |
|---|---|---|---|
| Question it answers | Does NIS2 apply to us and how much will implementation cost? | Which NIS2 and KSC Act requirements do we not meet? | How do we achieve compliance and prepare for a regulator audit? |
| Depth | Legal qualification, 1-day discovery session, maturity scoring (1-5) across 10 NIS2 areas | Entity classification and gap analysis of the 10 requirement areas based on evidence and interviews, including risk management, incident reporting and supply chain | Gap analysis, roadmap, policies and procedures, technical control implementation, training, regulator audit preparation |
| Deliverable | Report (20-30 pages), executive summary, roadmap, implementation cost estimate | Gap report with a compliance implementation plan and timeline | Implemented controls and compliance documentation |
| Who it is for | You don’t know whether NIS2 applies to you and the board wants a business case before the budget decision | You know you are an essential or important entity and need a formal gap report | You know your gaps or are starting from scratch and want to go all the way to compliance |
| Time | 2 weeks (Enterprise: 3-4 weeks) | 7-12 business days | 3-9 months |
| Price (net) | from €3,500 (Enterprise: individual quote after scoping) | from €6,000 (BASIC package: €6,000–€10,500) | €13,000–€50,500 including the gap analysis; with support during the authority’s audit from €64,000 |
The gap analysis within implementation is the same scope and price as the BASIC NIS2/KSC audit — the implementation price already includes it. On the KSC compliance page, Model 1 is the NIS2/KSC audit and Model 2 is NIS2 implementation from this table; compliance maintenance (Model 3) is quoted individually. Prices apply to NIS2 and the KSC Act (the Polish act implementing NIS2) — DORA is quoted separately.
Details: NIS2 Readiness Check · NIS2/KSC audit · NIS2 and DORA Compliance · KSC compliance
NIS2 Directive
Who Does NIS2 Apply To?
18 critical sectors:
- Energy (production, transmission, distribution of electricity, gas, oil)
- Transport (air, rail, water, road)
- Banking and financial market infrastructure
- Healthcare (hospitals, laboratories, pharmaceutical production)
- Drinking water and wastewater
- Digital infrastructure (cloud, data centers, CDN, DNS, registry)
- Public administration (government, local authorities)
- Space
- Waste management
- Food production, processing, and distribution
- E-commerce (online marketplaces)
- Postal and courier services
- ICT service management (B2B)
Size thresholds:
- Essential entities: medium and large enterprises
- Important entities: SMEs above 50 employees OR €10 million turnover
10 NIS2 Requirement Areas
- Risk management policies - identification, assessment, mitigation
- Incident management - detection, response, reporting (24h)
- Business continuity and crisis management - backup, DR, BCP
- Supply chain security - ICT supplier assessment
- Security of system acquisition, development, and maintenance - secure SDLC
- Effectiveness assessment policies and procedures - tests, audits, KPIs
- Basic cyber hygiene practices - MFA, encryption, patching
- Cybersecurity training - awareness for everyone
- Cryptography and encryption - data at rest and in transit
- Human resources security - access control, offboarding
NIS2 Violation Penalties
Essential entities:
- Up to €10 million OR 2% of annual global turnover (whichever is higher)
- Personal liability of management
Important entities:
- Up to €7 million OR 1.4% of annual turnover
NIS2 Incident Reporting
3 reporting levels:
- Early warning (24h) - notification of significant incident
- Notification (72h) - initial incident assessment
- Final report (1 month) - detailed report with impact and actions
Where to report: National CSIRT
DORA Regulation
Who Does DORA Apply To?
Financial institutions:
- Banks and credit institutions
- Investment firms
- Payment institutions and EMIs
- Insurance companies
- Pension and investment funds
- Crypto-asset service providers
Third-party ICT providers:
- Cloud providers for financial sector
- Software vendors
- Data analytics providers
5 DORA Pillars
- ICT risk management - framework, identification, protection
- ICT incident management - classification, reporting to regulator
- Digital resilience testing - TLPT (threat-led penetration testing)
- ICT third-party risk management - due diligence, SLA, audits
- Information sharing - threat intelligence, best practices
Key DORA Requirements
ICT Risk Management Framework:
- ICT risk management policy approved by management board
- Identification of all critical functions and dependencies
- Resilience testing at least once a year (every 3 years TLPT for large entities)
Incident reporting:
- Major incident: initial notification within 4 h of classifying the incident as major, no later than 24 h after becoming aware of it (RTS 2025/301)
- Intermediate report: after situation stabilization
- Final report: with root cause analysis and remediation actions
DORA Timeline
- 16 January 2023 - entry into force
- Q4 2024 - Q1 2025 - technical standards publication (RTS/ITS)
- 17 January 2025 - full DORA application
Related Glossary Terms
Learn more about key concepts related to this service:
How we work
Our proven service delivery process.
Scoping
Determine if you're subject to NIS2/DORA and scope
Gap Analysis
Current state assessment vs regulatory requirements
Roadmap
Prioritized remediation action plan
Implementation
Control and documentation deployment
Audit Support
Audit preparation and support
Benefits for your business
What you gain by choosing this service.
Avoid Fines
Up to €10M or 2% turnover for NIS2
Audit Readiness
Documentation and processes meeting requirements
Competitive Advantage
Clients and partners require compliance
Organized Processes
Clear roles, procedures, risk management
Related Articles
Expand your knowledge with our resources.
Third-party vendor access to critical systems: how do you control it under DORA?
The integrator of your core system, the firm that maintains your databases, the infrastructure service provider — each of them logs into systems your institution is accountable for, not theirs. We show how to turn DORA and Delegated Regulation 2024/1774 into concrete decisions about the account, the session and the evidence for audit.
Read more →Network traffic analysis with NetFlow and IPFIX flows: what you see, what you miss and how it supports NIS2
The firewall guards the perimeter, EDR guards devices with an agent. Traffic between servers, printers and cameras inside the network falls outside both. We show what can be detected from flows alone, when you need packet capture and what network data you need within 24 hours of detecting an incident.
Read more →How Bitdefender GravityZone supports NIS2 and the KSC Act: a map of 12 areas
The board asks whether GravityZone takes care of NIS2. The honest answer: it does not, but in twelve areas of Article 8 of the KSC Act it delivers technical controls and the data you prove action with. We map which module fits which area and which bundle you need for that to be true.
Read more →Frequently Asked Questions
Common questions about NIS2 and DORA Compliance.
Who does the NIS2 directive apply to?
NIS2 applies to companies in 18 sectors: energy, transport, banking, healthcare, water, digital infrastructure, public administration, space, postal services, food, chemicals, manufacturing, waste management, and more. Entities are divided into essential and important.
What are the penalties for NIS2 non-compliance?
NIS2 violation penalties can reach €10 million or 2% of global turnover (for essential entities) and €7 million or 1.4% of turnover (for important entities). Additionally, management bears personal responsibility.
How long does NIS2 implementation take?
Typical NIS2 implementation takes 3-9 months depending on current cybersecurity maturity. NIS2/KSC gap analysis takes 7-12 business days, roadmap development 1-2 weeks, and control implementation 2-8 months.
What's the difference between NIS2 and DORA?
NIS2 is a general cybersecurity directive for 18 sectors. DORA (Digital Operational Resilience Act) is a regulation dedicated to the financial sector with more detailed requirements for digital resilience, testing, and ICT risk management.
How much does NIS2 preparation cost?
NIS2 preparation costs depend on organization size and current security posture. NIS2/KSC gap analysis is €6,000 - €10,500 — the same scope as the BASIC NIS2/KSC audit. Implementation (including the gap analysis, documentation and support) is typically €13,000 - €50,500: from the package with roadmap and policies to a full KSC-compliant ISMS implementation; with support during the authority's audit from €64,000. If you don't know whether NIS2 applies to you, start with the NIS2 Readiness Check (from €3,500).