DORA or NIS2: which one applies to my (logistics) organisation?

Short answer: For a logistics organisation, NIS2 is almost always the relevant framework, not DORA. NIS2 explicitly lists transport (air, rail, road, water) as an essential sector. DORA applies only to financial entities. If you are both at once — for example a carrier holding a payment licence — DORA takes precedence for that part as the more specific rule.

Two frameworks with different scope

DORA (Regulation (EU) 2022/2554) and NIS2 (Directive (EU) 2022/2555) both govern digital resilience, but for different audiences. DORA targets an exhaustively listed set of financial entities: banks, insurers, investment firms, payment institutions, electronic money institutions and their critical ICT third-party providers. The regulation has applied since 17 January 2025. A logistics company is not on that list and therefore falls outside DORA — unless it itself carries out a regulated financial activity.

NIS2 takes a sectoral and size-based approach. The directive covers eighteen sectors, including transport, which is designated an essential sector. For a logistics organisation the question is therefore not whether the sector is in scope, but whether the company is large enough. Medium and large companies (generally from around 50 employees) are typically in scope; micro and small companies usually are not, with exceptions for critical parties.

What if both seem to apply?

An organisation can in principle fall under both frameworks, for instance when a logistics group operates its own payment or financing entity. NIS2 anticipates this. The directive provides that where a sector-specific Union act imposes requirements at least equivalent to those of NIS2, that more specific act takes precedence. DORA is expressly treated as such a lex specialis for the financial sector. For the financial part, the DORA obligations on ICT risk management, incident reporting and oversight of ICT third-party providers then apply; for the non-financial parts, the NIS2 obligations remain the starting point. Assess this per entity and per activity, because the boundary follows the regulated activity, not the group name.

National transposition sets the details

DORA is a regulation and applies directly in all Member States with uniform obligations. NIS2 is a directive and must be transposed into national law; in the Netherlands this is done through the Cyberbeveiligingswet. The transposition deadline was 17 October 2024 and implementation differs by Member State. The exact thresholds, sector boundaries and exceptions for your situation are therefore set out in the national legislation of the country where you operate. First determine your entity type and activity, then consult the applicable national law for the precise obligations and deadlines.

Read more: Transport & Logistics. Take the scan.