NIS2 & DORA
NIS2 & DORA Compliance for Businesses
Two EU regulations now decide how you manage cyber risk, report incidents and oversee suppliers. We work out which one applies to you, find the gaps, close them, and keep the evidence ready for the day someone asks for it.
What it is
Two regulations, one question: can you prove you are in control?
NIS2 is the EU directive on the security of network and information systems. It widened the set of organisations that must meet minimum cyber-security standards to cover energy, transport, health, banking, digital infrastructure, manufacturing, food, waste, postal services and many of the suppliers that serve them. Medium and large organisations in those sectors are generally in scope.
DORA, the Digital Operational Resilience Act, applies from 17 January 2025 and is aimed at the financial sector: banks, insurers, investment firms, payment and crypto-asset providers, and the ICT companies they depend on. Where an entity is covered by DORA, its rules take precedence over NIS2 for those matters.
Both ask for the same things in different words: documented risk management, defined responsibilities at management level, a tested way to detect and report incidents quickly, control over your suppliers, and evidence. The difficulty is rarely understanding the text. It is showing, months later, that the controls were running. Guardbyte treats it as an operational problem rather than a paperwork exercise.
At a glance
- Applicability check for NIS2 and DORA
- Gap analysis against the actual requirements
- Remediation, evidence and incident-reporting readiness
Delivered by Guardbyte’s advisory team and SOC. This is practical guidance, not legal advice: scope questions that depend on interpretation are best confirmed with your legal counsel.
Is your business ready for NIS2 and DORA?
Take our 15-question readiness check. It takes about 3 minutes and shows where you stand.
Is your business ready for NIS2 and DORA?
Capabilities
What the service covers
Applicability assessment
We establish whether NIS2, DORA or both apply to you, as an essential or important entity or as an ICT supplier, before any work is committed.
Gap analysis
Your current controls are compared against the requirements, with a prioritised list of what is missing and what is merely undocumented.
Risk management measures
Policies, access control, MFA, encryption, backup, vulnerability handling and secure development, implemented rather than only written.
Incident reporting readiness
NIS2 expects an early warning within 24 hours, a notification within 72 hours and a final report within a month. We build the process and rehearse it.
Supply chain & third-party risk
Supplier inventory, risk tiering and contract clauses, plus the register of ICT arrangements that DORA requires from financial entities.
Evidence & audit readiness
Dated, retrievable proof of operation, mapped to each requirement, so an inspection becomes a retrieval exercise instead of a scramble.
Managed by Guardbyte
A deadline is not a plan
Most organisations know the rules exist. What they lack is an owner, a sequence and the capacity to follow through. That is the part Guardbyte takes on.
01
Scoped to your obligations
We confirm which regulation applies to which part of the business, so you do not carry the cost of controls you are not required to have.
02
Gaps ranked by risk
Findings are prioritised by real exposure and effort, with quick wins separated from the projects that need budget approval.
03
Fixed by engineers
Because we run security operations, technical gaps such as MFA, logging, patching and backup are implemented by our own team.
04
Operated and evidenced
The SOC provides monitoring and incident handling, and evidence is collected continuously, ready for management review or an inspection.
FAQ
Questions we get asked
Does NIS2 apply to our company?
It depends on your sector and size. NIS2 covers essential and important entities across sectors such as energy, transport, health, banking, digital infrastructure, manufacturing and food, and generally targets medium and large organisations. Smaller suppliers can also be pulled in through contracts. We assess applicability first, and confirm borderline cases with your legal advisers.
What is the difference between NIS2 and DORA?
NIS2 is a cross-sector cyber-security directive. DORA is a regulation specific to financial entities and their critical ICT providers, and it is more prescriptive on resilience testing and third-party oversight. Where both could apply, DORA rules take precedence for the financial entity.
What do we have to report, and how fast?
Under NIS2, a significant incident needs an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. DORA has its own classification and reporting timelines for financial entities. Both depend on detecting an incident quickly, which is why monitoring matters as much as policy.
What are the penalties?
The directive sets maximum fines of at least 10 million euros or 2% of worldwide turnover for essential entities, and 7 million euros or 1.4% for important entities, whichever is higher. Member states set the actual regimes, and management bodies can be held accountable. Cost is rarely the real driver: a regulator asking for evidence you cannot produce is.
Are managers personally responsible?
NIS2 requires management bodies to approve and oversee cyber-security measures and to undergo training, and it allows national rules to hold them liable for failures. In practice this makes cyber risk a board topic, which is why our reporting is written for management as well as for IT.
Does this apply to our IT suppliers?
Yes, in both directions. Under NIS2 you are expected to manage supply-chain risk, so your suppliers will be asked for evidence. Under DORA, ICT third-party providers to financial entities are subject to direct contractual and, for critical providers, supervisory requirements.
Related solutions
Compliance Platform
Automated evidence for ISO 27001, NIS2 and DORA
Advisory Services
vCISO guidance and gap assessments
Security Rating Scorecard
External posture, supplier ratings, insurer evidence
Find out where you stand
A short scoping call will tell you which regulation applies, what you already satisfy and how long realistic remediation takes.
