NIS2 vs DORA vs CRA: Understanding the EU's Cybersecurity Regulation Landscape

The EU has launched three major cybersecurity regulations in rapid succession: NIS2 (2022/2555), DORA (2022/2554), and the Cyber Resilience Act (2024/2847). They overlap, interact, and sometimes conflict. If you're an infrastructure engineer at a regulated entity, you need to understand how they relate — because you'll likely need to comply with more than one.

Scope Comparison

• NIS2 — Broadest scope: 18 sectors, ~160,000 entities. Covers cybersecurity risk management for organizations providing essential or important services.
• DORA — Financial sector specific: banks, insurers, investment firms, payment providers, and their critical ICT third-party providers. Focused on digital operational resilience.
• CRA — Product-focused: any product with digital elements sold in the EU market. Covers hardware and software manufacturers. Focused on product security lifecycle.

How They Interact

NIS2 and DORA

DORA is lex specialis to NIS2 for the financial sector. This means: if you're a financial entity, DORA's requirements take precedence where they overlap with NIS2. But NIS2 still applies for areas DORA doesn't cover. In practice, DORA is stricter in most areas — if you comply with DORA, you largely satisfy NIS2 for those domains.

NIS2 and CRA

If you're a software manufacturer AND a NIS2 essential/important entity, both apply but to different things. NIS2 covers your organizational cybersecurity. CRA covers the security of the products you ship. Your internal infrastructure must meet NIS2. Your products must meet CRA. Different compliance streams, same security engineering team.

DORA and CRA

A financial institution using software products is subject to DORA (for their operations) while their software vendors must comply with CRA (for their products). DORA's third-party risk management requirements (Articles 28-44) effectively force ICT providers to the financial sector to meet DORA-like standards — which often exceed CRA's requirements.

Infrastructure Implications

For infrastructure teams, the practical approach is to build to the strictest standard and map compliance across regulations:

Capability	NIS2	DORA	CRA
Incident reporting	24h / 72h / 1 month	4h / 72h / 1 month	24h (to ENISA)
Risk management	Required	Required (stricter)	Product risk assessment
Testing	Regular testing	TLPT every 3 years	Conformity assessment
Supply chain	Supplier assessment	ICT TPP oversight	SBOM required
Vulnerability mgmt	Handling & disclosure	Patch management	5-year update obligation
Penalties	€10M / 2% turnover	€5M / 2% turnover	€15M / 2.5% turnover

Unified Compliance Infrastructure

Build once, comply many. The infrastructure capabilities are largely the same:

• SIEM + incident management — satisfies all three regulations' detection and reporting requirements
• Vulnerability management — continuous scanning satisfies NIS2, DORA, and CRA
• SBOM generation — required by CRA, expected by NIS2 supply chain requirements, helpful for DORA third-party risk
• Access control + MFA — required by NIS2 and DORA, good practice for CRA
• Backup and DR — required by NIS2 and DORA
• Audit logging — required by all three

What Open Empower Delivers

We help regulated enterprises navigate the overlap. Our platform engineering approach builds unified compliance infrastructure: one set of controls, mapped to multiple regulations. Whether you face NIS2, DORA, CRA, or all three — your infrastructure is ready.