NIS2 + DORA for Banks and Financial Services

1. DORA takes precedence over NIS2

The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied to financial services since 17 January 2025. For this sector, DORA replaces the equivalent NIS2 requirements as lex specialis. NIS2 only fills gaps that DORA does not address.

2. The five DORA pillars

1. ICT risk management framework with board accountability
2. ICT incident reporting on classified incidents to the competent authority
3. Digital operational resilience testing, including TLPT for significant institutions
4. ICT third-party risk management with mandatory contract clauses
5. Cyber threat intelligence sharing on a voluntary basis

3. BaFin supervision

BaFin (Federal Financial Supervisory Authority) is the competent supervisor for DORA compliance in Germany. The DORA framework runs alongside MaRisk, KAGB (Capital Investment Code), and KWG (German Banking Act). Audit programs typically combine all four.

4. Mandatory penetration testing

DORA Art. 26 requires Threat-Led Penetration Testing (TLPT) for significant institutions. Frequency: every three years. Methodology aligns with TIBER-EU. Tests must cover live production systems, supervised by independent threat-intelligence and red-team providers.

5. Third-party contract clauses

DORA Art. 28 prescribes specific mandatory clauses for ICT service providers to financial entities. These are stricter than the supply-chain provisions in Section 30 BSIG: full audit rights, sub-outsourcing approval, exit strategy, and explicit data-location commitments.

6. Penalty exposure

DORA fines reach up to 1% of group turnover for significant institutions. MaRisk and Section 56 KWG penalties apply on top. The board carries personal accountability for the ICT risk-management framework, similar in spirit to Section 38 BSIG management liability.

Summary

For banks and financial services, the cybersecurity playbook is DORA, not NIS2. ISO 27001 helps but does not satisfy DORA on its own; expect to map controls to all five pillars and budget for TLPT.

View NIS2 Kit →