NIS2 and DORA: what compliance actually costs a 500-employee supplier

Two regimes, two scopes, one supplier caught between them

The NIS2 Directive replaced NIS1 to raise the EU's common level of cybersecurity through a wider scope, clearer rules and stronger supervision tools, and it requires risk-management measures and reporting requirements from entities in more sectors than before. Member States had until 17 October 2024 to transpose it into national law, and NIS2 repealed NIS1 from 18 October 2024. For a 500-employee supplier, the first question is not which controls to buy but whether the national law where you are established lists your sector at all.

DORA is a different instrument with a different perimeter. It entered into application on 17 January 2025 and brings harmonised rules on operational resilience for the financial sector, applicable to 20 different types of financial entities and ICT third-party service providers. A 500-employee software or services supplier does not become a financial entity by selling to one, but its contracts sit inside a customer's DORA obligations, which is where the evidence requests arrive.

The overlap is real but narrow. NIS2 asks whether you run risk-management measures and notify significant incidents to a national authority; DORA asks whether the financial entity you serve can show ICT risk management, incident reporting to competent authorities and oversight of its third-party providers. A supplier answering both questionnaires is answering two regulators with one control set, and the control set is where the money goes.

What NIS2 adds on top of an ISO 27001 programme

An ISO 27001 certificate covers much of the control ground NIS2 describes, but the directive adds obligations a certificate does not evidence. Entities must notify relevant national authorities of significant incidents, defined as those that could cause significant disruption or damage, and that notification duty sits outside a typical ISMS audit cycle. The directive also introduces accountability of top management for non-compliance with cybersecurity risk-management measures, which turns a management review into a board-level record.

The scope test is the one that decides budget. NIS2 applies as a rule to medium-sized and large entities in the critical sectors it lists, and the Commission's own page names the additions over NIS1: providers of public electronic communications, more digital services such as social platforms, waste and wastewater management, critical product manufacturing, postal and courier services, public administration at central and regional level, and the space sector. A 500-employee manufacturer of critical products and a 500-employee social platform are both in scope; a 500-employee marketing agency is not, on the face of the text.

Member States must also establish and regularly update a list of operators of essential services, so registration is a national act with a national deadline, not a single EU filing. That is the first thing to verify: which national authority lists you, and what it asks for at registration. The directive text does not publish a fee, a timeline for registration or an evidence format, so those numbers are unpublished and the question to the authority is what a registration pack must contain.

What DORA adds when your customer is a bank

DORA's requirements are set out in four places the European Insurance and Occupational Pensions Authority lists: principles and requirements on the ICT risk management framework, reporting of major ICT-related incidents to competent authorities, and the regulation itself, Regulation (EU) 2022/2554 of 14 December 2022, alongside an amending directive. For a supplier, the practical weight is in the reporting and third-party provisions, because those are the ones a financial customer passes down the contract.

The oversight framework is the part that changes procurement. DORA establishes an EU-wide oversight framework for critical ICT third-party providers to address potential systemic and concentration risks arising from the financial sector's reliance on a limited number of ICT providers. A 500-employee supplier is unlikely to be designated critical, but its financial customers must still maintain a register of information on their ICT third-party arrangements, and that register is fed by what you tell them.

The supervisory machinery is still moving. EIOPA's page records the ESAs' response to the Commission's rejection of the implementing technical standards on registers of information, and a separate response on the regulatory technical standards on subcontracting. Those rejections mean the exact template for the register and the subcontracting rules were not settled at the point the page describes, so a supplier should ask its customer which version of the template it is being asked to complete rather than assume one.

Where the cost actually lands for a 500-employee supplier

Neither the Commission's NIS2 page nor EIOPA's DORA page publishes a compliance cost, a fee schedule or an audit price. That is a finding rather than a gap: the regimes are built on controls and evidence, and the bill arrives as staff time, auditor fees and contract negotiation, none of which either page quantifies. Anyone quoting a per-employee figure for either regime is quoting something the published material does not contain.

The one number the Commission does publish is about relief, not cost. On 20 January 2026, as part of a new cybersecurity package, the Commission proposed targeted amendments to NIS2 to increase legal clarity, and states the amendments will ease compliance for 28,700 companies, including 6,200 micro and small-sized enterprises. A 500-employee supplier is not in that micro and small band, so the simplification is unlikely to move its obligations, but the proposal signals that the scope is being actively adjusted and worth rechecking before signing a multi-year compliance contract.

The second published number is structural: NIS2 covers 18 critical sectors. That breadth is why a supplier selling across sectors may face the same questionnaire from customers in several of them, each mapped to a different national transposition. The cost driver is duplication of evidence, not the number of controls, and the cheapest way to cut it is a single evidence pack mapped once to ISO 27001 and once to the national NIS2 text that applies to you.

The shortlist: build the evidence pack, buy a managed service, or wait

A 500-employee supplier has three realistic routes. The first is to extend the existing ISO 27001 programme with the NIS2 reporting duty and the board record, using internal staff and the incumbent auditor, which keeps the control set in one place and adds the national registration step. The second is a managed compliance service that maintains the evidence pack and the register of information and maps them to both regimes, which trades a subscription for staff time. The third is to wait, which is only defensible where the national transposition does not list your sector and no financial customer has sent a DORA questionnaire.

The build route suits a supplier that already holds a certificate and has an auditor relationship, because the marginal work is the reporting process and the management accountability record rather than the controls themselves. The managed route suits a supplier selling into several member states where the national lists differ, because the service absorbs the mapping work and the template churn that the rejected DORA technical standards illustrate. The wait route suits a supplier outside the 18 sectors with no financial customers, and it should be revisited when the Commission's January 2026 amendment proposal moves.

On price, all three routes are quote-only in the published material. The questions that separate them are concrete: which national authority lists you, which DORA register template your customer is using, and whether your auditor will accept the same evidence for both. A supplier that cannot answer the first two is not ready to sign either a service contract or a customer contract.

The decision rule

Choose the in-house extension if you already hold ISO 27001, operate in one member state and can name the national authority that lists your sector, because the added work is the significant-incident notification and the top-management accountability record rather than a new control set. Choose a managed compliance service if you sell into several member states or to financial entities that send DORA register and subcontracting requests, because the mapping and template work is where the duplication cost sits and where the rejected technical standards keep the target moving. Wait only if your sector is outside the 18 NIS2 lists and no financial customer has asked for DORA evidence, and set a review date against the Commission's January 2026 amendment proposal rather than leaving it open.

Whichever route you take, the first thing to verify before signing is the national transposition text that applies to your entity, because NIS2 reaches you through national law and the directive page publishes no fee, no registration deadline and no evidence format. The second is which DORA register template your financial customers are completing, since the ESAs' response to the Commission's rejection of the implementing technical standards shows the template was contested. Get those two answers in writing and the rest of the compliance budget follows from them.