NIS2 + DORA for Banks and Financial Services

Main article: NIS2 implementation in Germany — scope, measures under Section 30 BSIG, management liability under Section 38 BSIG, reporting duties and fines at a glance.

1. DORA takes precedence over NIS2

DORA (Digital Operational Resilience Act, Regulation 2022/2554) has applied to financial services since 17 January 2025. NIS2 requirements are replaced by DORA for this sector (lex specialis).

For implementation this means: the dividing line does not run along the group but along the individual legal entity. Anyone falling under DORA is excluded from NIS2 (Art. 4 NIS2 Directive); non-financial subsidiaries of a banking group may fall under NIS2. In Germany, Annex 1 BSIG does list the financial sector (banking and financial market infrastructures) as a highly critical sector — but the BSIG obligations only apply where DORA does not take precedence. As an EU regulation, DORA applies in Austria in identical wording to Germany; Austria additionally orders the same precedence expressly: for entities within the scope of DORA, the provisions there take precedence (§ 4(2) and § 24(7) NISG 2026). The NISG 2026 (BGBl. I Nr. 94/2025, issued on 23 December 2025) becomes applicable on 1 October 2026.

Practical recommendation: First draw up a scope list per legal entity — DORA entity, NIS2 entity or neither. Without this allocation, neither registration nor reporting channel nor supervisory contact can be addressed correctly.

2. DORA obligations

DORA obliges financial entities to meet five sets of requirements: ICT risk management, the handling and reporting of ICT-related incidents, testing of digital operational resilience, management of ICT third-party risk, and information sharing. This article sets out two of them with their legal basis and operational consequences: threat-led testing under number 4 (Art. 26 DORA — TLPT at least every three years) and third-party risk under number 5 (Art. 28 DORA for the general principles, Art. 30(2) and (3) DORA for the mandatory clauses in the service provider contract).

For group entities outside the scope of DORA that qualify as particularly important or important entities under § 28 BSIG (number 7), the catalogue of measures in Section 30 BSIG takes their place in Germany. § 30(1) BSIG requires appropriate, proportionate and effective technical and organisational measures to avoid disruptions to the availability, integrity and confidentiality of IT systems and to keep the impact of security incidents low; compliance must be documented. § 30(2) BSIG names ten areas that every affected entity must address: (1) policies on risk analysis and information system security, (2) incident handling, (3) business continuity (backup management, recovery, crisis management), (4) supply chain security, (5) security in acquisition, development and maintenance, (6) assessment of the effectiveness of the measures, (7) cyber hygiene and training, (8) cryptography and encryption, (9) personnel security and access control, (10) multi-factor authentication, continuous authentication and secure communications. The depth of implementation scales with the risk — Section 30 BSIG requires appropriate and proportionate measures, not a rigid minimum list. In Austria, the substantively parallel catalogue is set out in § 32(4)(a) to (j) NISG 2026, in the same order.

3. BaFin supervision

For the DORA entities, BaFin is the competent supervisory authority in Germany. Alongside this, the German supervisory requirements for the institution itself remain decisive — in particular § 25a KWG, the KAGB and MaRisk; the penalties and supervisory consequences attached to them are set out under number 6.

On the NIS2 side, responsibility lies elsewhere. In Germany, the Federal Office for Information Security (BSI) is the central body for information security at national level (§ 1 BSIG) and at the same time the central NIS2 supervisory authority; alongside it, further federal and Land supervisory authorities may be competent for an entity's activities, and they must be stated on registration (§ 33(1) BSIG, number 8). A company may therefore be subject to several supervisory authorities; coordinating them is a compliance task. In Austria, NIS2 supervision is organised centrally at the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (Federal Office for Cybersecurity) from the date the NISG 2026 becomes applicable on 1 October 2026 — an authority directly subordinate to the Federal Minister of the Interior with nationwide responsibility (§ 3a(1) and (2) NISG 2026) and its seat in Vienna (§ 3b(3) NISG 2026); supervision and enforcement follow from §§ 38 and 39 NISG 2026. Sectoral differentiation there exists only at CSIRT level (§ 8(3) NISG 2026), not in supervision; administrative fines are imposed by the district administrative authority (§ 44(1) NISG 2026). Practical recommendation: Record in writing for each legal entity which supervisory authority is responsible; the reporting channels are set out under number 8.

4. Penetration testing obligation

Art. 26(1) DORA: advanced testing based on threat-led penetration testing (TLPT) at least every three years — the competent authority may reduce or increase the frequency in individual cases. Subject to TLPT are not simply 'significant institutions' but the financial entities identified by the competent authority under Art. 26(8) subparagraph 3 DORA (criteria: impact on the financial sector, financial stability, ICT risk profile); microenterprises are exempt. Classification as a significant credit institution under Art. 6(4) of Regulation (EU) No 1024/2013 has a separate effect: those institutions may use external testers only (Art. 26(8) subparagraph 2 DORA).

For group entities subject to NIS2, the point of reference is a different one: § 30(2) no. 6 BSIG requires policies and procedures to assess the effectiveness of the risk management measures; in Austria, the effectiveness assessment is part of the parallel catalogue in § 32(4) NISG 2026. Practical recommendation (the law prescribes no interval for the effectiveness assessment under § 30(2) no. 6 BSIG; the three-yearly evidence obligation for operators of critical installations under § 39(1) BSIG remains unaffected — see number 9): KPIs per area of measures — for example patch compliance rate, phishing click rate, recovery time —, quarterly reporting to management, an annual penetration test, plus internal audit and external audit every two years.

5. Third-party contract clauses

The mandatory contractual content for ICT service providers is set out in Art. 30 DORA ('Key contractual provisions'): Art. 30(2) lists the minimum elements of any arrangement on ICT services (among others a description of services including the conditions for subcontracting, processing and storage locations, availability/authenticity/integrity/confidentiality, data access and return, service levels, assistance with ICT incidents, cooperation with the authorities, termination rights and minimum notice periods). For ICT services supporting critical or important functions, additional mandatory clauses apply under Art. 30(3) (among others quantitative performance targets, contingency plans, participation in TLPT, unrestricted rights of access, inspection and audit).

Art. 28 DORA, by contrast, contains no list of clauses but the general principles of ICT third-party risk management — for example the financial entity's continuing full responsibility, the principle of proportionality, the risk assessment and due diligence before entering into a contract (paragraph 4), minimum information security standards (paragraph 5), the grounds for termination to be secured contractually (paragraph 7) and exit strategies. The DORA requirements therefore go considerably further than the general requirement of 'supply chain security' in § 30(2) no. 4 BSIG.

What § 30(2) no. 4 BSIG means in practice for group entities subject to NIS2: a supplier assessment with risk classification, cybersecurity clauses in the standard contracts, a right to audit for critical suppliers and a contractually agreed incident report from the supplier to the client. Practical recommendation: agree a deadline of 24 hours for this contractual report — it is not a statutory supplier deadline. In our practical assessment, alongside the supply chain, implementation gaps frequently also appear in the effectiveness assessment (§ 30(2) no. 6 BSIG) and in training and awareness measures (§ 30(2) no. 7 BSIG). In Austria, the equivalent of the supply chain requirement is § 32(4)(d) NISG 2026.

6. Fine risk

DORA itself names no upper fine limit for financial entities. Under Art. 50(3) DORA, the member states set appropriate administrative penalties and remedial measures which must be effective, proportionate and dissuasive; Art. 50(4) DORA merely names the minimum powers of the competent authorities (e.g. cease-and-desist orders, discontinuation of practices).

The frequently cited 1 % limit is not a fine against institutions but a periodic penalty payment against critical ICT third-party service providers: up to 1 % of the average worldwide daily turnover of the preceding financial year, imposed by the lead overseer, on a daily basis and for a maximum of six months (Art. 35(6) to (8) DORA). For institutions, the national penalty rules apply — in Germany, among others, the fine provisions of § 56 KWG; MaRisk deficiencies are addressed under supervisory law.

For group entities subject to NIS2 (§ 28 BSIG) a separate framework applies. The following overview names exclusively penalty and liability provisions of the NIS2 implementation (Germany: BSIG, Austria: NISG 2026); DORA penalties are described in the two paragraphs above; the Austrian penalty ranges apply from the date the NISG 2026 becomes applicable on 1 October 2026.

Unlike the Directive, the BSIG does not contain a blanket 'whichever is higher' rule: the turnover variant applies only where total turnover exceeds EUR 500 million and only for the breaches designated in § 65(6) and (7) BSIG. Total turnover here is the sum of all worldwide revenues of the undertaking to which the entity belongs in the financial year preceding the authority's decision (§ 65(8) BSIG). If a data protection supervisory authority has already imposed a GDPR fine for the same conduct, an additional fine under the BSIG is excluded (§ 65(11) BSIG).

7. NIS2 classification of group units outside the DORA scope

Whether a group entity outside the scope of DORA is subject to NIS2 is decided in Germany by § 28 BSIG. As a rule, two tests must be met together: allocation to an entity type in Annex 1 or Annex 2 BSIG and reaching the size threshold. For operators of critical installations, by contrast, the classification applies irrespective of size. Each row of the following overview names its own condition; the columns must be read together.

Two pitfalls: first, turnover alone is never sufficient — § 28(1) no. 4(b) BSIG requires turnover above EUR 50 million and in addition a balance sheet total above EUR 43 million; only the headcount from 250 upwards operates as a stand-alone criterion. Second, there is no headcount ceiling for important entities: because § 28(1) no. 4 BSIG covers exclusively entity types under Annex 1, a group company with 5,000 employees that can only be allocated to an Annex 2 type remains an important entity. For the calculation of headcount, annual turnover and balance sheet total, Recommendation 2003/361/EC applies with the exception of Art. 3(4) of its Annex (§ 28(4) BSIG); group membership may bring linked undertakings into the calculation.

For banking and financial groups, two entries besides the financial sector are particularly relevant: Annex 1 BSIG names digital infrastructure including the management of ICT services (managed services), Annex 2 BSIG names among others providers of digital services. Whether a group-owned IT or data centre company falls under these must be assessed on the basis of the specific entity type.

In Austria, § 25(2) and (3) NISG 2026 uses the same size tiers, applicable from the date the NISG 2026 becomes applicable on 1 October 2026: large undertaking from 250 employees or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total; medium-sized undertaking from 50 employees or more than EUR 10 million annual turnover and more than EUR 10 million balance sheet total. Large undertakings of the Annex 1 types are essential entities (§ 24(1) no. 3 NISG 2026); Annex 1 and Annex 2 types that are large or medium-sized undertakings are important entities (§ 24(2) no. 1 NISG 2026).

8. Registration and reporting channels for NIS2 entities

Group entities subject to NIS2 must register and report significant security incidents in stages — three mandatory stages (24 h / 72 h / one month) plus an intermediate report on request and a progress report for an ongoing incident — with different addressees in Germany and Austria. In Germany, registration takes place under § 33(1) BSIG via a registration facility set up jointly by the BSI and the Federal Office of Civil Protection and Disaster Assistance (BBK) — in practice via the 'Mein Unternehmenskonto' portal —, and at the latest three months after an entity first or again qualifies as a particularly important or important entity. Mandatory details are the name including legal form and, where applicable, commercial register number, address and current contact details including email, public IP address ranges and telephone numbers, the relevant sector under Annex 1 or 2, the list of EU member states in which services are provided, as well as the competent federal and Land supervisory authorities. Changes must be transmitted without undue delay, at the latest two weeks after becoming aware of them (§ 33(5) BSIG). Operators of critical installations register by way of derogation under § 8 KRITIS Umbrella Act (KRITIS-Dachgesetz), in so far as § 33(2) BSIG already applies (§ 66 BSIG); if registration does not take place, the BSI may carry it out itself (§ 33(3) BSIG). The deadline runs from the moment the entity status arises, not from a single calendar date — a missed registration must be made up.

In Austria, essential and important entities register with the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (§ 29(2) NISG 2026) within three months of entry into force, i.e. by the end of 2026 (§ 29(3)); changes to the core data must be notified within two weeks (§ 29(4)). Group structures with German and Austrian companies register separately.

The following overview names exclusively the statutory reporting stages of the NIS2 implementation; DORA reporting deadlines are not covered. The Austrian column applies from the date the NISG 2026 becomes applicable on 1 October 2026.

The addressee in Germany is the joint reporting office of the BSI and the BBK, in Austria the competent sector-specific CSIRT or, in the absence of one, the national CSIRT, which forwards the report to the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (§ 34(1) NISG 2026). The decisive concept is the significant security incident under § 2 no. 11 BSIG: an incident that has caused or may cause severe operational disruption of the services or financial loss for the entity, or that has affected or may affect other natural or legal persons by causing considerable material or non-material damage. For certain digital entity types — among others cloud and data centre services as well as managed (security) service providers — EU Implementing Regulation 2024/2690 specifies this threshold with quantitative criteria (cf. § 30(3) BSIG); for all other entities, the definition in § 2 no. 11 BSIG applies until a statutory instrument is adopted under § 56(5) BSIG. Austria defines the significant incident in largely identical wording in § 35(1) NISG 2026. The 24-hour deadline is triggered by awareness, not by the start of the incident; practical consequence: anyone wishing to meet it needs round-the-clock availability — external SOC service providers can take this on.

9. Management and evidence of implementation

In Germany, responsibility for the NIS2 measures lies with management itself and cannot be delegated. § 38(1) BSIG obliges the management of particularly important and important entities to implement the risk management measures under Section 30 BSIG and to supervise their implementation. If they breach these duties, they are liable to their entity for culpably caused damage under the rules of the company law applicable to the legal form; under the BSIG itself, management is liable only subsidiarily, namely where the relevant company law contains no such liability rule (§ 38(2) sentence 2 BSIG). In addition there is the duty to take part in training on a regular basis (§ 38(3) BSIG).

In Austria, from the date the NISG 2026 becomes applicable on 1 October 2026, the management bodies of essential and important entities must ensure and supervise compliance with the risk management measures under § 32 NISG 2026 and take part in specifically designed cybersecurity training; corresponding training must be offered to employees on a regular basis (§ 31(1) and (2) NISG 2026). The NISG 2026 contains no internal liability rule analogous to § 38(2) BSIG.

The two legal areas differ considerably when it comes to evidence of implementation. In Germany, the regular obligation to provide evidence through security audits, examinations or certifications applies primarily to operators of critical installations: at a point in time set by the BSI, at the earliest three years after they first qualify as the operator of a critical installation, and every three years thereafter; the results, including any security deficiencies identified, must be transmitted (§ 39(1) BSIG). In Austria, a broader rule applies from 1 October 2026: essential and important entities transmit structured information on the risk management measures implemented to the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) within twelve months of the registration obligation arising (self-declaration, § 33(1) NISG 2026). On request, implementation must be evidenced within two years by an independent body; essential entities must provide evidence of operational and organisational implementation within as little as two months of the request (§ 33(2) NISG 2026).