NIS2 and DORA have reshaped the legal landscape for European businesses. Organisations that fail to act now risk significant fines and operational disruption. Find out where you stand — free, in minutes.
NIS2 and DORA came into force in 2023 and 2025. Both impose binding cybersecurity obligations — with no grace period for companies already in scope.
NIS2 expanded the original NIS Directive to cover a much wider range of sectors. It introduces mandatory security measures, incident reporting obligations, and board-level accountability for cybersecurity. Member States began national enforcement in October 2024.
Sectors Covered
DORA applies exclusively to financial sector entities. It establishes binding standards for ICT risk management, operational resilience testing, third-party ICT dependency management, and incident reporting. Full application began in January 2025.
Entities Covered
Structured questionnaires built on the regulation text. AI analysis delivered to your inbox in minutes. Free account required.
Answer 20 questions across 5 NIS2 compliance areas. Get a gap analysis with your risk profile, missing measures, and priority actions — delivered to your inbox.
Answer 20 questions across 5 DORA pillars. Get a readiness score, key ICT risk gaps, and a prioritised action plan — delivered to your inbox.
A tailored supplier due diligence questionnaire covering up to 6 EU regulations: GDPR, NIS2, DORA, EU AI Act, CS3D, and CRA — based on your supplier's profile, data access, and criticality. Includes risk level, DPA requirement flag, and recommended review frequency.
NIS2 alone covers 160,000+ entities across the EU — far more than many businesses realise. Use the checklist below to understand your likely exposure.
Energy, transport, banking, health, drinking water, digital infrastructure, public administration, and space sectors. NIS2 applies to medium and large companies (50+ employees or €10M+ revenue).
Postal services, waste management, chemicals, food production, manufacturing, digital providers, and research organisations. Same employee and revenue thresholds apply.
Banks, investment firms, insurance companies, crypto-asset providers, and payment institutions. DORA applies regardless of company size if you hold an EU financial services licence.
Even if you are not directly in scope, if you supply services to NIS2-covered or DORA-covered entities, you will face contractual cybersecurity requirements from your clients.
NIS2 applies to non-EU companies providing services to EU customers in covered sectors. DORA applies to ICT providers serving EU financial entities, regardless of where the provider is based.
Our free assessments start by profiling your organisation — sector, size, and activity type — before any compliance questions. If you're not in scope, we'll tell you that too.
Run the NIS2 or DORA assessment today. Free account, no payment required. Get your AI-generated gap analysis in minutes.