In brief
- Regulation: NIS2.
- Insurers are in scope under NIS2 as part of the financial sector, but the bulk of their resilience obligations fall under DORA.
- Identifying the prevalence of DORA.
- Ensure consistency.
- Coordinating notifications.
- NIS2 provides for up to €10 M or 2%, but its application is residual in insurance, where DORA's prudential framework structures supervision.
Regulatory deadlines
The key dates of this regulation.
January 2023
Entry into force (EU directive)
In forceOctober 2024
Transposition deadline (EU)
In force2026
French transposition (Resilience Act)
In forceWhat does NIS2 cover?
NIS2 establishes a horizontal cybersecurity baseline across many sectors, including the financial sector. Where a sector-specific act imposes at least equivalent requirements, it takes precedence: this is the case with DORA for financial entities with regard to ICT risk and incidents.
The insurer therefore structures its resilience around DORA and mobilises NIS2 only for the residual.
Is the 'Insurance' sector affected?
Insurers are covered by NIS2 under the financial sector, but the bulk of their resilience obligations falls under DORA. The value of this guide is to clarify what remains applicable under NIS2 once DORA is applied.
This alignment avoids duplication in governance, measures, and notifications.
Detailed obligations
Identify the prevalence of DORA
Recognise that DORA constitutes the lex specialis for ICT risk and incidents.
Ensure consistency
Ensuring that measures satisfy DORA and cover the residual NIS2 scope without duplication.
Coordinating notifications
Coordinate DORA and, where applicable, NIS2 channels to avoid duplicate notifications.
Documenting the articulation
Formalise a mapping showing how DORA covers the ICT scope.
Sanctions & risks
NIS2 provides for up to €10M or 2%, but its application is residual in insurance, where DORA's prudential regime structures supervision. The main risk is a poorly articulated framework generating duplications or blind spots.
A clear mapping of both texts is the best protection.
Application timeline
- 1DORA. Applicable from 17 January 2025; takes precedence for ICT risk.
- 2NIS2. French transposition in progress; residual scope for insurance.
Common mistakes in the sector
- 1Duplicated devices. Building two parallel NIS2 and DORA frameworks.
- 2Ignored prevalence. Failing to recognise that DORA takes precedence for ICT risk.
- 3Duplicate notifications. Notify the same incident twice without coordination.
- 4Undocumented articulation. Failing to formalise the mapping of obligations.
Practical case
An insurer had launched NIS2 work prior to DORA. It rationalises by placing DORA at the centre of its ICT resilience, reassigning NIS2 work to the residual scope and unifying its incident procedures, eliminating duplication.
Compliance roadmap
- 1
Map. Comparing the fields covered by DORA and by NIS2.
- 2
Prioritise DORA. Structuring ICT resilience around DORA.
- 3
Cover the residual risk. Addressing NIS2 points not covered by DORA.
- 4
Coordinate. Coordinate notifications to avoid duplicates.
- 5
Document. Formalising the interface for authorities and audits.
Frequently asked questions
Yes, under the financial sector framework, but DORA prevails for ICT risk and incidents; NIS2 plays only a residual role.
Take action on NIS2
Free assessment or a chat with an expert dedicated to insurance.
They already trust us
See how organisations in the insurance sector secured their compliance with DCO.