How to Prepare for NIS2 and DORA Compliance

NIS2 and DORA are the two European Union regulations reshaping how organizations prove their cyber resilience. NIS2 (Directive (EU) 2022/2555) raises the cybersecurity baseline across  essential and important entities in 18 sectors, while DORA (Regulation (EU) 2022/2554) sets  binding digital operational resilience rules for the financial sector and its technology suppliers.  Both shift the standard from “having a policy” to demonstrating, with evidence, that your people,  processes, and technology can withstand a real cyber incident. 

This guide explains what each regulation requires, who falls in scope, and a practical six-step  approach to preparing, framed around the principle that anchors how Immersive helps  organizations meet these obligations: prove, improve, be ready. 

KEY FACTS: NIS2 VS DORA AT A GLANCE 

NIS2 type: EU Directive — transposed into each member state’s national law 

DORA type: EU Regulation — directly applicable, no transposition needed 

NIS2 scope: ~160,000+ essential and important entities across 18 sectors 

DORA scope: Financial entities (banks, insurers, investment firms, crypto-asset providers)  and their critical ICT third-party providers 

Key dates: NIS2 transposition deadline 17 Oct 2024; DORA applicable since 17 Jan 2025 

Maximum NIS2 fines: Up to €10M or 2% of global annual turnover (essential entities)

Shared theme: Tested, evidenced operational resilience, not documentation alone

What are NIS2 and DORA? 

What is NIS2? 

NIS2 is the EU’s updated Network and Information Security Directive. It replaces the original  2016 NIS Directive with a wider scope, harmonized security requirements, stricter incident  reporting, and management accountability backed by GDPR-scale fines. It applies to “essential”  and “important” entities in sectors including energy, transport, health, digital infrastructure,  water, public administration, manufacturing, and ICT service management. 

What is DORA? 

DORA, the Digital Operational Resilience Act, is an EU regulation that sets a single, binding  framework for how financial entities manage information and communication technology (ICT)  risk. Because it is a regulation rather than a directive, DORA applies directly and uniformly across all member states. It covers financial firms and, importantly, brings their critical ICT third-party providers under regulatory oversight for the first time. 

The two are designed to work together rather than overlap. Where DORA governs a specific area for a financial entity, that firm follows DORA as the more specific law (lex specialis), while  NIS2 sets the broader cybersecurity baseline for everyone else. For a fuller map of how these fit alongside other regimes, see Immersive’s comprehensive guide to key cybersecurity regulations. 

Who needs to comply with NIS2 and DORA? 

The fastest way to scope your obligations is to ask two questions: what sector are you in, and where do you operate or provide services? 

‍

Many enterprises fall under both. A manufacturer with a financial services arm, or a technology  vendor serving EU banks, may need to satisfy NIS2 obligations for one part of the business and  DORA for another. Mapping this early prevents duplicated effort and missed requirements. 

What do NIS2 and DORA require? 

NIS2 requirements 

• Risk management measures: a defined set of technical and organizational controls,  including incident handling, business continuity, and supply chain security.

• Three-phase incident reporting: an early warning within 24 hours, a fuller incident notification within 72 hours, and a final report within one month. 

• Management accountability: senior leaders must approve and oversee cybersecurity measures and can be held personally liable for failures. 

• Supply chain security: entities must assess and manage the cyber risk posed by their direct suppliers and service providers. 

DORA requirements: the five pillars 

1. ICT risk management: a comprehensive framework covering identification, protection,  detection, response, and recovery. 

2. ICT-related incident management and reporting: classify, manage, and report major incidents to competent authorities on defined timelines. 

3. Digital operational resilience testing: regular testing of systems and people, including threat-led penetration testing (TLPT) for significant entities. 

4. ICT third-party risk management: contractual and oversight obligations for the technology providers that financial firms depend on. 

5. Information sharing: voluntary exchange of cyber threat intelligence between financial entities. 

How to prepare for NIS2 and DORA compliance 

Preparation is most effective when it produces evidence that regulators, boards, and insurers will accept. The following six steps move an organization from a documentation-led posture toward demonstrable resilience. 

6. Map scope and identify gaps. Confirm which regulations and national laws apply to each part of the business, then benchmark your current controls against their requirements to find the gaps that matter most. 

7. Establish governance and accountability. Assign clear ownership at the board and management level. Under NIS2, leadership accountability is explicit, so decision-makers need genuine visibility of cyber risk, not a quarterly slide. 

8. Build and rehearse incident reporting. Stand up the workflows behind the 24-hour, 72- hour, and one-month NIS2 timelines (and DORA’s reporting obligations), then rehearse  them under realistic pressure so the clock does not start during a live crisis. 

9. Run digital operational resilience testing. Go beyond tabletop talk. Threat-led penetration testing, technical range exercises, and full crisis simulations reveal what teams actually do when systems are degraded and information is incomplete. 

10. Address supply chain and ICT third-party risk. Inventory critical suppliers, assess their resilience, and update contracts to reflect NIS2 supply chain duties and DORA’s third-party oversight requirements. 

11. Move from one-off to continuous validation. Compliance is a point in time; resilience is a capability you maintain. Re-test on a regular cadence, close the gaps on each exercise  surfaces, and track improvement over time.

Why compliance alone won’t make you resilient 

The most important thing to understand about NIS2 and DORA is that passing an audit is not the same as being ready. An organization can hold every certification and still freeze when a  real incident hits, because controls were misconfigured, playbooks were never tested, and  teams did not know their roles under pressure. 

‍

“Historically, compliance has meant that you’re ready for incidents. But because  you’ve got SOC 2 or ISO 27001, because you’ve got the capability to pass an audit, it doesn’t mean you’ve got a cyber resilience capability. That’s the real evolution  we’ve seen in a lot of our long-term customers: moving away from ‘we believe we  have a capability because we have an accreditation.’” 

— Kev Marriott, Senior Manager of Cyber, Immersive

‍

This is the gap NIS2 and DORA are designed to close. Both regulations increasingly expect tested, evidenced capability, which is why operational resilience testing sits at the heart of  DORA and incident-handling assessment runs through NIS2. 

How Immersive helps you prepare for NIS2 and DORA 

Immersive One is the platform for continuous cyber resilience. Rather than treating compliance  as a paperwork exercise, it helps organizations prove readiness against real-world threats,  improve where exercises expose gaps, and report measurable progress in the language boards  and regulators expect. 

• Crisis Simulations align crisis response to frameworks including NIST, ISO, and DORA,  and include regulation-specific scenarios such as a NIS2 breach-reporting exercise, so leadership can rehearse the exact decisions and disclosures these laws demand. 

• Cyber Range Exercising and team drills put technical teams through high-fidelity,  adversary-aligned scenarios mapped to MITRE ATT&CK, supporting DORA’s digital operational resilience testing expectations. 

• Hands-on labs and workforce exercises close the specific skill gaps each drill surfaces,  turning exercise findings into measurable capability rather than another report. 

• The Resilience Score and audit-ready reporting quantify readiness as a single,  trackable metric and auto-generate evidence packs that capture drills, exercises, and outcomes in clear business language, the proof NIS2 and DORA increasingly require.

‍

The result is a continuous cycle, prove, improve, be ready, that satisfies the letter of NIS2 and  DORA while building the resilience their spirit is really after. Learn more about improving cyber resilience with Immersive. 

Prove your readiness for NIS2 and DORA 

Don’t wait for a real incident or an audit to find out whether your organization is ready. Book a demo to see how Immersive One helps you prove, improve, and be ready for NIS2, DORA, and whatever comes next.

Frequently asked questions 

Is NIS2 the same as DORA? 

No. NIS2 is a broad directive covering essential and important entities across 18 sectors, while  DORA is a regulation focused specifically on the financial sector and its ICT third-party providers. Where they overlap for financial entities, DORA takes precedence as the more specific law. 

When did NIS2 and DORA come into effect? 

DORA has applied directly across the EU since 17 January 2025. NIS2 had a transposition deadline of 17 October 2024, after which member states have been enacting national laws, with enforcement and the first administrative penalties beginning in 2026. 

Does DORA replace NIS2 for financial firms? 

For the specific areas DORA covers, financial entities follow DORA rather than the equivalent  NIS2 provisions. They may still fall under other NIS2 obligations and national rules, so most run a combined compliance program. 

What are the penalties for NIS2 non-compliance? 

Penalties are set by each member state, but the directive allows administrative fines of up to  €10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities,  alongside potential personal accountability for management bodies. 

Do NIS2 and DORA require testing of your incident response? 

Yes. DORA mandates a digital operational resilience testing program, including threat-led penetration testing for significant entities, and NIS2 requires entities to adopt and assess incident-handling and business continuity measures. Both expect tested, evidenced capability rather than documentation alone.